S22 resumable four-run closure campaign

S22 closure is one durable campaign with four disposable runs:

1. provisional Matrix A;
2. provisional Matrix B;
3. an independent governance review and deterministic transition;
4. final Matrix A;
5. final Matrix B;
6. offline verification of the sealed history.

The campaign journal is a resumable projection, never terminal authority. Its terminal_authority field is always null. The content-addressed terminal bundle and owner-only activation marker are staging inputs. Final authority requires the signed root-broker envelope produced from the measured no-FFI sealed-replay worker; a naked marker or marker-only verifier result is insufficient.

This procedure starts only disposable S22 stacks. It does not build, deploy, restart, or contact a production Chorus instance.

Prepare

Run from the repository root. The image must already be reviewed and digest-pinned. Choose a new canonical campaign directory and an owner-only review path.

set -eu

ROOT=$(git rev-parse --show-toplevel)
cd "$ROOT"

: "${CHORUS_IMAGE:?set a reviewed IMAGE@sha256:DIGEST reference}"

GOVERNANCE=$ROOT/.gsd/milestones/M001/S22-GOVERNANCE-STATE.json
GOVERNANCE_PARENT=$(dirname "$GOVERNANCE")
TRANSITION_ATTEMPTS_PARENT=$ROOT/.gsd/milestones/M001/slices/S22/transition-attempts
: "${TRANSITION_ATTEMPT_ID:?set one fresh 32-character lowercase hex ID and retain it}"
[[ $TRANSITION_ATTEMPT_ID =~ ^[0-9a-f]{32}$ ]]
LAUNCHER_STATE=$TRANSITION_ATTEMPTS_PARENT/\
s22-launcher-provision-$TRANSITION_ATTEMPT_ID
TRANSITION_PARENT=$TRANSITION_ATTEMPTS_PARENT/\
s22-foundation-transition-$TRANSITION_ATTEMPT_ID
CAMPAIGN=$ROOT/.gsd/milestones/M001/slices/S22/campaigns/\
s22-campaign-$TRANSITION_ATTEMPT_ID
REVIEW=$ROOT/.gsd/milestones/M001/slices/S22/reviews/\
s22-independent-review-$TRANSITION_ATTEMPT_ID.json

# The transition atomically publishes authority only beneath exact current-UID,
# owner-only parents. Never apply this to a directory owned by another UID.
mkdir -p "$GOVERNANCE_PARENT" "$TRANSITION_ATTEMPTS_PARENT"
for directory in "$GOVERNANCE_PARENT" "$TRANSITION_ATTEMPTS_PARENT"; do
  test "$(stat -c %u "$directory")" -eq "$(id -u)"
  chmod 700 "$directory"
  test "$(stat -c %a "$directory")" = 700
done
test "$LAUNCHER_STATE" != "$TRANSITION_PARENT"
for attempt_directory in "$LAUNCHER_STATE" "$TRANSITION_PARENT"; do
  mkdir --mode=0700 -- "$attempt_directory"
  test "$(realpath -e -- "$attempt_directory")" = "$attempt_directory"
  test "$(stat -c '%u %a' "$attempt_directory")" = "$(id -u) 700"
done

test "$(jq -r .schema_version "$GOVERNANCE")" = chorus.s22-governance-state/3
test "$(jq -r .phase "$GOVERNANCE")" = provisional
test "$(jq -r .reviewer_policy.state "$GOVERNANCE")" = provisioned

The checked-in governance state now contains a provisioned Sophie/Aurora reviewer policy. Their two public keys are sorted and independently identified, and both review_quorum and risk_quorum are 2. Their private keys stayed with the agents; no review, risk, trust-policy, or terminal-intent signature occurred merely because the public policy was provisioned. DF20 implementation/review is closed; its real review/risk signatures remain campaign evidence and every matrix binding stays pending.

Pre-campaign foundation authentication is a different role. A separately root-custodied foundation-attestor policy contains at least two independently held public keys and a quorum of at least two. Its key IDs and identity IDs are disjoint from every governance reviewer, risk approver, campaign operator, and forbidden identity. Foundation attestors may sign only the versioned pre-campaign trust payload; they do not review provisional outcomes. Sophie/Aurora do not sign that payload and remain silent until provisional A/B has produced the exact Review v3 payload.

Any replacement reviewer policy must still supply:

• a canonical s22-reviewer-policy-* ID and a fresh 32-byte unpadded-base64url nonce;
• sorted unique Ed25519 public keys encoded as canonical SPKI DER then unpadded base64url; each key_id is ed25519-sha256:<sha256-of-SPKI-DER>;
• one canonical identity:* ID and sorted roles (reviewer, risk-approver) per key;
• review_quorum and risk_quorum values of at least two, each achievable over distinct eligible identities; and
• sorted unique identity boundaries: operator_identity_ids must name at least one campaign operator, while forbidden_identity_ids may be empty. Neither class can contribute a signature.

Private keys stay with independent reviewers and must never be committed, placed in the campaign directory, copied into an assembly request, or transferred to the campaign operator.

Do not create or edit campaign.json yourself. The CLI writes it atomically under an owner/process-identity lock. A killed owner is recovered by exact inode-bound stale-lock takeover; simultaneous resumptions serialize.

start rechecks both transition authority parents before it invokes any lifecycle work. An existing parent owned by another UID or with a mode other than exact 0700 fails immediately; the campaign never weakens that boundary automatically.

Prepare the pre-campaign measured foundation

start also authenticates one fixed campaign trust root. There is deliberately no development override and no caller-selected trust path. Before provisional Matrix A, the local host must therefore have these five exact root-owned, single-linked files, all beneath root-owned non-group/other-writable ancestors:

Fixed path	Mode	Signed binding
/etc/chorus/s22/m001/foundation-attestor-policy.json	0400	disjoint foundation public-key quorum
/etc/chorus/s22/m001/campaign-trust-policy.json	0400	foundation-attestor quorum over trust-policy v2
/etc/chorus/s22/m001/broker-runtime-policy.json	0400	trust-policy broker commitment
/etc/chorus/s22/m001/broker-build-receipt.json	0400	trust-policy build commitment
/etc/chorus/s22/m001/aot-build-receipt.json	0400	trust-policy AOT commitment

This is a local approval-gated foundation operation. It does not install or invoke a setuid launcher, write a terminal intent, start a service, contact a production endpoint, or deploy Chorus. Creating the dedicated no-login account, root-owned staging trees, broker seed, and public-only foundation export also belongs to this first gate. Installing the signed trust candidate needs a later digest-bound gate; the full 16-file broker installation and broker invocation each need their own later gates.

Build the root-frozen candidates

Stage the reviewed native inputs, build script, AOT builder, Bun 1.3.14, Rollup 4.60.2, and the measured source tree under the approved root-owned foundation. Every root-frozen source/toolchain file is root-owned, single-linked, and non-writable; every ancestor is root-owned and not writable by group or others. The native path uses all four commands exposed by scripts/build-s22-measured-launcher.sh in order:

1. toolchain-manifest;
2. source-manifest over the exact staged launcher, preload, protocol, build-script, and pinned Monocypher inputs;
3. build-host-anchor, followed by the separately approved no-clobber publication of that exact anchor at /etc/chorus/s22/m001/broker-build-host-trust-anchor.json; and
4. build, invoked through the root-staged manifested copy of the script.

All four native-builder commands use the same approval-bound launch shape below, with the command name and absolute arguments fully expanded in the approved executor. The environment is cleared before privileged Bash starts, so BASH_ENV and exported shell functions cannot affect startup. Do not use a shell alias, function, relative path, sudo bash, or a PATH lookup for the privileged shell or staged build script. S22_ROOT_BUILDER and every pathname argument must be a canonical absolute path whose bytes and root custody are bound by the gate.

/usr/bin/sudo -H /usr/bin/env -i \
  PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC HOME=/nonexistent \
  /usr/bin/bash --noprofile --norc -p \
  "$S22_ROOT_BUILDER/scripts/build-s22-measured-launcher.sh" \
  '<toolchain-manifest|source-manifest|build-host-anchor|build>' \
  '<approved absolute arguments for that command>'

This is a required invocation contract, not a copy-and-run command with literal angle brackets. The approved executor contains four concrete invocations in the listed order and names no unapproved executable. Clearing variables inside an already-started Bash process is insufficient because startup processing would already have happened.

The AOT source root is separate from the builder/toolchain root and contains only the frozen measured source closure plus its empty bunfig.toml, exact {}\n tsconfig.json, and output directory. Every directory in that root has exact mode 0555; the emitted dist/s22-measured-terminal-worker.mjs has exact mode 0555; and every other source-manifest entry has exact mode 0444. All are root:root, single-generation, and non-writable. These exact modes make the tree searchable and readable by the non-root phase-one operator while preserving root custody. Phase one remeasures this exact root rather than a copy. Render and immediately replay the real captured worker through the public command:

: "${S22_ROOT_BUN:?root-owned Bun 1.3.14}"
: "${S22_ROOT_BUILDER:?root-owned builder tree}"
: "${S22_ROOT_SOURCE:?root-owned measured source tree}"
: "${S22_AOT_CANDIDATE:?new root-owned candidate path}"

/usr/bin/sudo -H /usr/bin/env -i \
  PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC HOME=/nonexistent \
  BUN_JSC_useJIT=false BUN_JSC_useRegExpJIT=false BUN_JSC_useWasm=false \
  "$S22_ROOT_BUN" \
  --no-install --no-env-file \
  --cwd="$S22_ROOT_SOURCE" --config="$S22_ROOT_SOURCE/bunfig.toml" \
  "$S22_ROOT_BUILDER/scripts/generate-s22-measured-aot-candidate.ts" render \
  --source-root "$S22_ROOT_SOURCE" \
  --candidate-directory "$S22_AOT_CANDIDATE" \
  --authority root-frozen-production

/usr/bin/sudo -H /usr/bin/env -i \
  PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC HOME=/nonexistent \
  BUN_JSC_useJIT=false BUN_JSC_useRegExpJIT=false BUN_JSC_useWasm=false \
  "$S22_ROOT_BUN" \
  --no-install --no-env-file \
  --cwd="$S22_ROOT_SOURCE" --config="$S22_ROOT_SOURCE/bunfig.toml" \
  "$S22_ROOT_BUILDER/scripts/generate-s22-measured-aot-candidate.ts" verify \
  --source-root "$S22_ROOT_SOURCE" \
  --candidate-directory "$S22_AOT_CANDIDATE"

candidate.json is written last at mode 0400. It binds the fixed captured entrypoint, emitted bundle, root-frozen receipt, policy, source root, digests, sizes, and modes. verify performs a fresh deterministic rebuild and rejects a changed byte, mode, path, source object, toolchain object, or executable-map closure. The receipt hashes one canonical measured-build invocation containing the exact Bun and tool paths, source/candidate roots, entrypoint, output, and authority. Both public commands derive that same build invocation; their wrapper verbs (render and verify) are deliberately not treated as different builds.

Recover an incomplete foundation candidate

Writers never delete or overwrite an incomplete output automatically. Once an output pathname has been created, any write, permission, sync, validation, or interruption failure leaves that pathname intact as incomplete evidence. This avoids a pathname check/delete race and makes recovery independent of whether the failed process can re-establish the originally opened inode.

For an incomplete AOT bundle or descriptor, quarantine the incomplete tree and use a fresh source root plus a fresh candidate directory. For an incomplete trust payload, signature, assembly, or authority candidate, retain the failed path and select a new output name. Do not copy any incomplete artifact into the public foundation, sign it, or use it as an approved digest. Record the abandoned paths in the gate evidence before continuing.

If a failed attempt already published the fixed build-host anchor, never replace, remove, or reuse that anchor and never resume its foundation. A fresh, separately approved candidate may be built only through a supervised child mount, network, and PID namespace that keeps the host anchor view unchanged. The bootstrap plan remains the exact chorus.s22-bootstrap-plan/1 contract. Freeze the plan plus six root-custodied file descriptors before opening a gate. The gate binds the plan separately by identity, canonical path, SHA-256, size, and mode; it does not hide the plan among the descriptor set. The six descriptors bind bootstrap-supervisor (a static, approval-bound bootstrap supervisor), executor.sh, stage-manifest.tsv, executor-tool-closure.tsv, closure-renderer.ts, and closure-renderer-config.json. This order is normative:

{
  "plan": {
    "name": "bootstrap-plan.json",
    "identity": "chorus.s22-bootstrap-plan/1",
    "gate_fields": ["path", "sha256", "size_bytes", "mode"]
  },
  "descriptors": [
    "bootstrap-supervisor",
    "executor.sh",
    "stage-manifest.tsv",
    "executor-tool-closure.tsv",
    "closure-renderer.ts",
    "closure-renderer-config.json"
  ]
}

The plan binds every package source and canonical root-custody path, SHA-256, and size. Destination modes are fixed by the reviewed inline custody body and static supervisor rather than caller-selected plan fields. The separately supplied plan digest prevents the plan from attempting to contain its own hash.

Freeze additional approval-bound evidence outside that seven-file plan: the exact inline custody body; its chorus.s22-bootstrap-argv/3 28-element argv v3 contract; the root-preflight body and result; the package inode-custody manifest; the launcher and its dependency closure; the independent stage-map result; the reviewed supervisor source and build-driver snapshots; and the supervisor build-provenance publication. Upload each item as immutable evidence before approval. The inline body and argv description are evidence, never files that root loads from an operator-writable pathname.

The supervisor build-provenance publication is a complete enumerated provenance publication. Its manifest names every published relative path and binds its SHA-256, size, mode, and role, including the supervisor binary, build receipt, source and toolchain manifests, frozen compiler-read closure, ELF inspection outputs, and all retained per-pass evidence for independent pass A and pass B: binaries, objects, dependency files, preprocessor state, normalized traces, and ELF profiles. Directory enumeration must equal that manifest exactly, and the build receipt must cross-bind the binary used by the plan. Do not replace this enumeration with a fixed artifact count until the reviewed driver is frozen. A changed source, driver, toolchain, output set, or receipt restarts package construction in a fresh private directory.

The tool closure is rendered from the exact executor text, the 34-entry native toolchain manifest, the reviewed Bun runtime, and the eight Rollup inputs. It recursively binds every ELF PT_INTERP and DT_NEEDED target, plus /etc/ld.so.cache. Rendering and both replayers require /etc/ld.so.preload to be absent; the render result and gate evidence record that fact, while the TSV itself contains only file and alias rows. The gate binds the canonical path, SHA-256, size, owner, group, mode, link count, device, and inode of each of these four executables: /usr/bin/unshare, /usr/bin/mount, /usr/bin/findmnt, and /usr/bin/umount. It also binds every other absolute host executable in the custody and executor command, including /usr/bin/sudo, /usr/bin/env, /usr/bin/bash, /usr/bin/mkdir, and /usr/bin/cp. Remeasure the entire approved closure immediately before launch. Sudo and its policy/PAM configuration remain the host trust boundary; do not describe the ELF closure as proof of configuration-selected plugins. Before dynamic Bash starts, select the exact approved Bash PT_INTERP loader and require its resolved inode, digest, and dependency closure to equal the gate-bound values; a merely equivalent loader pathname is not accepted.

The executor embeds the closure SHA-256 and size, while the closure renderer parses the executor’s exact host-tool declaration. Its output-independent config has schema chorus.s22-executor-tool-closure-render/2; the renderer accepts that config followed by one separate exclusive output-path argument. Resolve the dependency with a checked fixed point: render one provisional closure from the finalized literal set; substitute that closure commitment and every other final package value into the executor; write a new canonical renderer config bound to that exact final executor; then render fresh A and B outputs with the same canonical config and two distinct exclusive output-path arguments. Both final outputs must be byte-identical to each other and to the provisional closure. Each begins with chorus.s22-executor-tool-closure/2, followed by its file rows and the chorus.s22-executor-tool-aliases/1 marker; every alias target must also have one exact file row. The closure does not contain an executor file row, so this equality is possible; the root-custodied plan and final renderer config bind the exact executor bytes that were parsed. Any changed literal set restarts the sequence.

The foundation root preflight has its own approval before candidate-input finalization. It is action host.s22_foundation_root_preflight with canonical payload chorus.s22-foundation-root-preflight-approval/1. The snapshot is published first; only then may the approval bind that exact snapshot and request generation. The approval artifact is created after the snapshot and is never one of its retained publications. The later candidate-build approval cannot authorize the root preflight, and the root-preflight approval cannot authorize candidate construction.

[
  "snapshot-v1",
  "approval-v1",
  "gate-request-v1",
  "approvals create",
  "approvals approve-to-file",
  "approvals execution begin",
  "capture-approved-v1",
  "reconcile-v1",
  "approvals execution finish",
  "finalize-v1",
  "host.s22_foundation_candidate_build"
]

Use fresh owner-only paths for every capture below. Inspect and explicitly approve the preflight gate before beginning execution. capture-approved-v1 holds and validates the snapshot, request, approval, signed begin attestation, output parent, reviewed producers, native verifier, selected key, and trusted ancestors before it can derive its private lease. Its sole privileged start is fenced and non-replayable. After any retained fence, result, failure, interruption, or ambiguous state, use its read-only reconcile-v1; never repeat capture. Once the child is known stopped and terminal evidence is classified, finish the exact attempt once as succeeded or terminal_failure. After an interruption, resume at reconcile-v1 with a fresh response path. If finish output is ambiguous, repeat only the same idempotent finish into a fresh response path; finish never grants another privileged start.

: "${S22_BUILDER:?frozen reviewed builder tree}"
: "${S22_BUILDER_BUN:?reviewed Bun 1.3.14}"
: "${APPROVER_IDENTITY:?explicit human approver identity}"
: "${S22_RECOVERY_INPUT_SNAPSHOT_CONFIG:?fresh snapshot-v1 config}"
: "${S22_RECOVERY_INPUT_SNAPSHOT_RESPONSE:?fresh snapshot response}"
: "${S22_RECOVERY_INPUT_SNAPSHOT:?published snapshot.json}"
: "${S22_PREFLIGHT_APPROVAL:?fresh owner-only approval path}"
: "${S22_PREFLIGHT_GATE_REQUEST:?fresh owner-only gate request path}"
: "${S22_PREFLIGHT_GATE_CREATE:?fresh owner-only gate-create response}"
: "${S22_PREFLIGHT_APPROVAL_RESPONSE:?fresh owner-only approval response}"
: "${S22_PREFLIGHT_ATTEMPT_ID:?stable attempt ID for this exact gate}"
: "${S22_PREFLIGHT_ATTESTATION:?fresh owner-only signed begin artifact}"
: "${S22_PREFLIGHT_BEGIN_RESPONSE:?fresh owner-only begin response}"
: "${S22_PREFLIGHT_RESULT:?fresh result path in the retained output parent}"
: "${S22_PREFLIGHT_CAPTURE_RESPONSE:?fresh capture response}"
: "${S22_PREFLIGHT_RECONCILE_RESPONSE:?fresh reconciliation response}"
: "${S22_PREFLIGHT_FINISH_RESPONSE:?fresh finish response}"
: "${S22_RECOVERY_INPUT_FINALIZE_CONFIG:?fresh finalize-v1 config}"
: "${S22_RECOVERY_INPUT_FINALIZE_RESPONSE:?fresh finalization response}"

S22_RECOVERY_INPUT_TOOL=\
"$S22_BUILDER/scripts/prepare-s22-foundation-recovery-input.ts"
S22_PREFLIGHT_APPROVAL_TOOL=\
"$S22_BUILDER/scripts/prepare-s22-foundation-root-preflight-approval.ts"
S22_PREFLIGHT_CAPTURE_TOOL=\
"$S22_BUILDER/scripts/capture-s22-foundation-root-preflight.ts"
S22_CHORUS_CLI="$S22_BUILDER/packages/cli/src/index.ts"

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_RECOVERY_INPUT_TOOL" \
    snapshot-v1 --config "$S22_RECOVERY_INPUT_SNAPSHOT_CONFIG" \
    >"$S22_RECOVERY_INPUT_SNAPSHOT_RESPONSE"
)

"$S22_BUILDER_BUN" "$S22_PREFLIGHT_APPROVAL_TOOL" \
  approval-v1 "$S22_RECOVERY_INPUT_SNAPSHOT" \
  --output "$S22_PREFLIGHT_APPROVAL"

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_PREFLIGHT_APPROVAL_TOOL" \
    gate-request-v1 "$S22_PREFLIGHT_APPROVAL" \
    --approver-identity "$APPROVER_IDENTITY" \
    >"$S22_PREFLIGHT_GATE_REQUEST"
)
S22_PREFLIGHT_EXPECTED_FINGERPRINT=$(
  "$S22_BUILDER_BUN" "$S22_PREFLIGHT_APPROVAL_TOOL" \
    fingerprint-v1 "$S22_PREFLIGHT_APPROVAL"
)

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_CHORUS_CLI" approvals create \
    --profile inu --from-file "$S22_PREFLIGHT_GATE_REQUEST" --json \
    >"$S22_PREFLIGHT_GATE_CREATE"
)
S22_PREFLIGHT_GATE_ID=$(
  /usr/bin/jq -er '.id' "$S22_PREFLIGHT_GATE_CREATE"
)

"$S22_BUILDER_BUN" "$S22_CHORUS_CLI" approvals approve-to-file \
  "$S22_PREFLIGHT_GATE_ID" --profile inu \
  --expected-action-type host.s22_foundation_root_preflight \
  --expected-action-fingerprint "$S22_PREFLIGHT_EXPECTED_FINGERPRINT" \
  --output "$S22_PREFLIGHT_APPROVAL_RESPONSE" \
  --note "I authorize exactly one local read-only S22 foundation root preflight."

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_CHORUS_CLI" approvals execution begin \
    --profile inu \
    --attempt-id "$S22_PREFLIGHT_ATTEMPT_ID" \
    --approval-response "$S22_PREFLIGHT_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$S22_PREFLIGHT_EXPECTED_FINGERPRINT" \
    --attestation-output "$S22_PREFLIGHT_ATTESTATION" \
    --json >"$S22_PREFLIGHT_BEGIN_RESPONSE"
)
S22_PREFLIGHT_REVISION=$(
  /usr/bin/jq -er '
    select((.status == "accepted" or .status == "resumed")
      and .execution_authorized == true)
    | .attempt.revision
  ' "$S22_PREFLIGHT_BEGIN_RESPONSE"
)

set +e
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_PREFLIGHT_CAPTURE_TOOL" \
    capture-approved-v1 "$S22_RECOVERY_INPUT_SNAPSHOT" \
    "$S22_PREFLIGHT_APPROVAL" "$S22_PREFLIGHT_ATTESTATION" \
    --gate-id "$S22_PREFLIGHT_GATE_ID" \
    --attempt-id "$S22_PREFLIGHT_ATTEMPT_ID" \
    --revision "$S22_PREFLIGHT_REVISION" \
    --output "$S22_PREFLIGHT_RESULT" \
    >"$S22_PREFLIGHT_CAPTURE_RESPONSE"
)
S22_PREFLIGHT_CAPTURE_STATUS=$?
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_PREFLIGHT_CAPTURE_TOOL" \
    reconcile-v1 "$S22_PREFLIGHT_APPROVAL" \
    >"$S22_PREFLIGHT_RECONCILE_RESPONSE"
)
set -e

S22_PREFLIGHT_FINISH_ERROR=
S22_PREFLIGHT_FINISH_ERROR_ARGS=()
if test "$S22_PREFLIGHT_CAPTURE_STATUS" -eq 0 && /usr/bin/jq -e '
  .state == "completed"
  and .terminal == true
  and .child_may_still_exist == false
  and .read_only == true
  and .privileged_replay == false
' "$S22_PREFLIGHT_RECONCILE_RESPONSE" >/dev/null
then
  S22_PREFLIGHT_FINISH_OUTCOME=succeeded
  S22_PREFLIGHT_EXPECTED_STATE=succeeded
elif /usr/bin/jq -e '
  (.state == "failed" or .state == "ambiguous" or .state == "not-dispatched")
  and .child_may_still_exist == false
  and .read_only == true
  and .privileged_replay == false
' "$S22_PREFLIGHT_RECONCILE_RESPONSE" >/dev/null
then
  S22_PREFLIGHT_FINISH_OUTCOME=terminal_failure
  S22_PREFLIGHT_EXPECTED_STATE=abandoned
  S22_PREFLIGHT_FINISH_ERROR=root_preflight_not_verified
  S22_PREFLIGHT_FINISH_ERROR_ARGS=(
    --error "$S22_PREFLIGHT_FINISH_ERROR"
  )
else
  echo "Preflight is not safely terminal; do not finish, recapture, or finalize." >&2
  false
fi

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_CHORUS_CLI" approvals execution finish \
    --profile inu \
    --attempt-id "$S22_PREFLIGHT_ATTEMPT_ID" \
    --approval-response "$S22_PREFLIGHT_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$S22_PREFLIGHT_EXPECTED_FINGERPRINT" \
    --revision "$S22_PREFLIGHT_REVISION" \
    --outcome "$S22_PREFLIGHT_FINISH_OUTCOME" \
    "${S22_PREFLIGHT_FINISH_ERROR_ARGS[@]}" \
    --json >"$S22_PREFLIGHT_FINISH_RESPONSE"
)
/usr/bin/jq -e \
  --arg state "$S22_PREFLIGHT_EXPECTED_STATE" \
  --arg error "$S22_PREFLIGHT_FINISH_ERROR" \
  --argjson revision "$S22_PREFLIGHT_REVISION" '
  (.status == "finished" or .status == "idempotent")
  and .execution_authorized == false
  and .attempt.state == $state
  and .attempt.revision == ($revision + 1)
  and (if $state == "succeeded" then .attempt.last_error == null
       else .attempt.last_error == $error end)
' "$S22_PREFLIGHT_FINISH_RESPONSE" >/dev/null
test "$S22_PREFLIGHT_EXPECTED_STATE" = succeeded

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_RECOVERY_INPUT_TOOL" \
    finalize-v1 --config "$S22_RECOVERY_INPUT_FINALIZE_CONFIG" \
    >"$S22_RECOVERY_INPUT_FINALIZE_RESPONSE"
)

Snapshot, request, result, and finalized candidate-input formats remain unchanged. The retired unsigned capture-v1 is test-only and is never a production command. The candidate-preparation executable closure contains schemas and production sources, not .gsd design contracts: the approval schema, canonical module, renderer, approved capture, TypeScript verifier, native verifier, and native verifier build wrapper are the complete source closure loaded or executed across this boundary. The design spec remains non-executable review context and cannot become execution authority.

1. Record the current boot ID, initial user namespace, all three host namespace IDs (mount, network, and PID), and the fixed anchor’s digest, device, inode, owner, mode, link count, size, mtime, and ctime. Namespace identities use canonical decimal st_dev:st_ino; names alone are insufficient. After the complete package is frozen but before a gate is opened, run the exact current-boot root preflight under explicit operator control. It enters fresh private mount and PID namespaces, mounts a fresh procfs, proves its parent mount/network/PID identities differ while its user namespace is unchanged, and verifies namespace type, ownership, and retained parent/child witnesses through NS_GET_NSTYPE, NS_GET_USERNS, and NS_GET_PARENT. Its PID-namespace init opens the actual frozen stage manifest at FD 16384 and keeps running while one direct child closes its inherited copy and remeasures /proc/1/fd/16384. The preflight also proves the soft descriptor limit covers 16384 + unique_source_count, that procfs belongs to that PID namespace, and that the measured stage bytes match the frozen package. Capture its canonical owner-only result and bind both body and result into the gate. A reboot, namespace change, package change, or failed parent-FD proof requires a fresh result and gate.

2. Render the exact canonical bootstrap plan. Its fresh campaign directory must not exist. The root bootstrap uses a fixed inline command under root-owned Bash: it creates that directory at mode 0700, copies the approved supervisor into it, remeasures the root-owned copy against the approved digest and size, syncs both inode and directory, and only then executes that canonical copy. A user-writable supervisor path must never be executed directly with elevated authority. The operator-facing launcher assigns every value from the immutable approval evidence and must apply these guards before the call:

   : "${S22_ROOT_CUSTODY_COMMAND:?approval-bound inline body is required}"
   : "${S22_CAMPAIGN:?approved campaign is required}"
   : "${S22_BOOTSTRAP_SUPERVISOR_SOURCE:?approved supervisor source is required}"
   : "${S22_BOOTSTRAP_SUPERVISOR_SHA256:?approved supervisor digest is required}"
   : "${S22_BOOTSTRAP_SUPERVISOR_SIZE:?approved supervisor size is required}"
   : "${S22_BOOTSTRAP_PLAN_SOURCE:?approved plan source is required}"
   : "${S22_BOOTSTRAP_PLAN_SHA256:?approved plan digest is required}"
   : "${S22_EXPECTED_USERNS_DEV_INO:?approved user namespace identity is required}"
   : "${S22_EXPECTED_PARENT_MNTNS_DEV_INO:?approved parent mount namespace identity is required}"
   : "${S22_EXPECTED_PARENT_NETNS_DEV_INO:?approved parent network namespace identity is required}"
   : "${S22_EXPECTED_PARENT_PIDNS_DEV_INO:?approved parent PID namespace identity is required}"
   : "${S22_STAGE_UNIQUE_SOURCE_COUNT:?approved unique stage-source count is required}"
   : "${S22_STAGE_FD_MAP_SHA256:?approved stage FD-map digest is required}"

   The approval binds this exact 28-element outer argv after variables are resolved. The canonical document schema is chorus.s22-bootstrap-argv/3:

   [
     "/usr/bin/sudo",
     "-H",
     "/usr/bin/env",
     "-i",
     "PATH=/usr/bin:/bin",
     "LANG=C",
     "LC_ALL=C",
     "TZ=UTC",
     "HOME=/nonexistent",
     "/usr/bin/bash",
     "--noprofile",
     "--norc",
     "-p",
     "-c",
     "<INLINE_CUSTODY_BODY_BYTES>",
     "s22-bootstrap-inline",
     "<CAMPAIGN_ID>",
     "<BOOTSTRAP_SUPERVISOR_SOURCE_PATH>",
     "<BOOTSTRAP_SUPERVISOR_SHA256>",
     "<BOOTSTRAP_SUPERVISOR_SIZE_BYTES_DECIMAL>",
     "<BOOTSTRAP_PLAN_SOURCE_PATH>",
     "<BOOTSTRAP_PLAN_SHA256>",
     "<EXPECTED_USERNS_DEV_INO>",
     "<EXPECTED_PARENT_MNTNS_DEV_INO>",
     "<EXPECTED_PARENT_NETNS_DEV_INO>",
     "<EXPECTED_PARENT_PIDNS_DEV_INO>",
     "<STAGE_UNIQUE_SOURCE_COUNT_DECIMAL>",
     "<STAGE_FD_MAP_SHA256>"
   ]

   The inline body’s exact twelve positional arguments are the final twelve entries above:

   [
     "<CAMPAIGN_ID>",
     "<BOOTSTRAP_SUPERVISOR_SOURCE_PATH>",
     "<BOOTSTRAP_SUPERVISOR_SHA256>",
     "<BOOTSTRAP_SUPERVISOR_SIZE_BYTES_DECIMAL>",
     "<BOOTSTRAP_PLAN_SOURCE_PATH>",
     "<BOOTSTRAP_PLAN_SHA256>",
     "<EXPECTED_USERNS_DEV_INO>",
     "<EXPECTED_PARENT_MNTNS_DEV_INO>",
     "<EXPECTED_PARENT_NETNS_DEV_INO>",
     "<EXPECTED_PARENT_PIDNS_DEV_INO>",
     "<STAGE_UNIQUE_SOURCE_COUNT_DECIMAL>",
     "<STAGE_FD_MAP_SHA256>"
   ]

   /usr/bin/sudo -H /usr/bin/env -i \
     PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC HOME=/nonexistent \
     /usr/bin/bash --noprofile --norc -p -c "$S22_ROOT_CUSTODY_COMMAND" \
     s22-bootstrap-inline "$S22_CAMPAIGN" \
     "$S22_BOOTSTRAP_SUPERVISOR_SOURCE" \
     "$S22_BOOTSTRAP_SUPERVISOR_SHA256" "$S22_BOOTSTRAP_SUPERVISOR_SIZE" \
     "$S22_BOOTSTRAP_PLAN_SOURCE" "$S22_BOOTSTRAP_PLAN_SHA256" \
     "$S22_EXPECTED_USERNS_DEV_INO" \
     "$S22_EXPECTED_PARENT_MNTNS_DEV_INO" \
     "$S22_EXPECTED_PARENT_NETNS_DEV_INO" \
     "$S22_EXPECTED_PARENT_PIDNS_DEV_INO" \
     "$S22_STAGE_UNIQUE_SOURCE_COUNT" \
     "$S22_STAGE_FD_MAP_SHA256"

   Here argv 14 is the exact inline body, argv 15 is Bash’s $0, and argv 16 through 27 are its twelve positional arguments. Each namespace identity must match canonical decimal st_dev:st_ino. The command string is an approval artifact, not an ambient shell function or a file loaded by root. It uses only absolute tools named by the closure, derives the canonical destination from the campaign, and creates that directory exclusively. The body caps the approved supervisor at 16 MiB, rejects a non-regular or symbolic-link source, and performs a no-dereference, no-preserve copy under both an exact file-size limit and a 30-second TERM plus 5-second KILL bound.

   After syncing the root-owned copy, the exact body opens the parent mount and network namespace witnesses at fixed FDs 10 and 11 and verifies them against the approved identities. It then uses the reviewed absolute unshare to enter fresh private mount, network, and PID namespaces, set private propagation, and mount procfs. One fixed inner Bash body opens the child mount and network witnesses at FDs 12 and 13 before it executes the canonical supervisor as PID-namespace init. The nine-entry supervisor launch vector, including argv zero, is exact:

   [
     "<CANONICAL_ROOT_BOOTSTRAP_SUPERVISOR>",
     "<BOOTSTRAP_PLAN_SOURCE_PATH>",
     "<BOOTSTRAP_PLAN_SHA256>",
     "<EXPECTED_USERNS_DEV_INO>",
     "<EXPECTED_PARENT_MNTNS_DEV_INO>",
     "<EXPECTED_PARENT_NETNS_DEV_INO>",
     "<EXPECTED_PARENT_PIDNS_DEV_INO>",
     "<STAGE_UNIQUE_SOURCE_COUNT_DECIMAL>",
     "<STAGE_FD_MAP_SHA256>"
   ]

   [0] CANONICAL_BOOTSTRAP_SUPERVISOR
   [1] PLAN_SOURCE
   [2] PLAN_SHA256
   [3] EXPECTED_USERNS_DEV_INO
   [4] EXPECTED_PARENT_MNTNS_DEV_INO
   [5] EXPECTED_PARENT_NETNS_DEV_INO
   [6] EXPECTED_PARENT_PIDNS_DEV_INO

   The supervisor is PID 1. Before closing inherited descriptors it proves FDs 10 through 13 are the exact nsfs mount/network witnesses, the parent witnesses equal the approved identities, the current namespaces equal the child witnesses, and each child differs from its parent. It proves the current PID namespace’s kernel-reported parent equals the approved parent PID identity, all new namespaces are owned by the approved user namespace, and procfs belongs to that PID namespace. The supervisor clears the environment again before dynamic Bash, using the same PATH=/usr/bin:/bin and HOME=/nonexistent values required by the executor.

3. The canonical supervisor validates its own plan entry, then copies the plan, executor, stage manifest, tool closure, closure renderer, and renderer config through already-open stable file descriptors into exclusive root-owned paths. It syncs every file and parent. Inside the verified private mount namespace it installs read-only bind mounts from already-open custody FDs over the canonical executor and stage paths, then proves the mounted inodes still equal the plan. Separately, it opens, measures, pins, and read-leases every file row in the executor tool closure. It bind-mounts each retained row FD read-only over that row’s exact canonical target in the private namespace, re-resolves every declared alias after all mounts are present, and requires each alias to reach its bound retained inode. For every dynamic executable, the pinned loader’s --list selection must name and resolve to exactly the bound interpreter and dependency rows. Those closure-row mounts, pinned FDs, leases, alias checks, path-event ledger, and repeated identity/digest measurements form the pinned and leased read-only runtime view; any break terminates supervision.

   Stage-source transport is a separate map. The supervisor parses the destination-sorted stage, opens each distinct source exactly once in first-seen source order, takes and retains a read lease, and assigns those pinned source descriptors consecutively from FD 16384. These source FDs are not substituted for closure rows or canonical executor/stage custody mounts.

   Before starting dynamic Bash, the supervisor proves /etc/ld.so.preload is absent before, between, and after two complete closure passes, remeasures every closure row in both passes, and selects the exact approved Bash PT_INTERP loader from the closure. The canonical static supervisor remains the direct living parent of privileged Bash until every descendant has been reaped. Its independent outer watchdog sends TERM after 1,800 seconds and KILL 30 seconds later. Outer TERM is 300 seconds after inner TERM and 270 seconds after the inner KILL deadline; it bounds executor preflight and postflight, not the preceding root-custody phase. Neither watchdog extends the other.

4. The executor repeats the closure and loader checks, verifies its supervisor through /proc/$PPID/exe, and validates every placeholder before creating any foundation pathname. The supervisor invokes it with this exact six-argument executor contract:

   --supervised "$S22_STAGE_MANIFEST" "$S22_BOOTSTRAP_SUPERVISOR_PID" \
     16384 "$S22_STAGE_UNIQUE_SOURCE_COUNT" "$S22_STAGE_FD_MAP_SHA256"

   The executor requires the supplied supervisor PID to equal $PPID, the FD base to be exactly 16384, the count to fit both the reviewed bound and current soft descriptor limit, and the digest to be canonical lowercase SHA-256. Before creating the foundation it parses the stage twice and independently reconstructs the map in first-seen source order. Repeated source labels must retain one digest and size. The exact map preimage begins with chorus.s22-bootstrap-stage-fd-map/1, then contains one newline-terminated row per unique source:

   {
     "schema_version": "chorus.s22-bootstrap-stage-fd-map/1",
     "fd_base": 16384,
     "source_order": "first-seen-distinct-source",
     "row_fields": ["SOURCE_INDEX", "16384+SOURCE_INDEX", "SHA256", "SIZE", "SOURCE_PATH"],
     "row_separator": "TAB",
     "row_terminated_by": "LF",
     "parent_fd_only_copy": true,
     "original_source_path_open": false
   }

   SOURCE_INDEX<TAB>16384+SOURCE_INDEX<TAB>SHA256<TAB>SIZE<TAB>SOURCE_PATH

   Both executor recomputations must equal each other, the supervisor-supplied count and digest, the executor literals, and the approval-v4 evidence. After parsing, every original source path is a provenance label only: the executor never opens an original stage-source pathname. For row source index source_index, its only byte transport is /proc/$S22_BOOTSTRAP_SUPERVISOR_PID/fd/$((16384 + source_index)). The executor remeasures that parent FD immediately before and after each copy, requires stable identity, size, and digest, copies into a fresh canonical destination, remeasures the destination’s identity, ownership, mode, size, and digest, and data-syncs the file. It then rechecks every staged destination and syncs the foundation parent.

   Publish stage-fd-copy-log.tsv and stage-fd-transport.json exclusively under the root-private receipt directory. They bind the stage and map commitments, parent PID, FD base/count, every source-index-to-FD assignment, source pre/post measurements, destination measurements, completed file and parent syncs, row count, and logical bytes. Namespace-entry, outer-attempt, and final foundation descriptors bind both receipt digests; a partial copy retains evidence and cannot publish the final descriptor.

   After staging, the executor launches the exact form below beneath the already-cleared environment; no namespace tool is resolved through PATH:

   /usr/bin/timeout --signal=TERM --kill-after=30s 1500s \
     /usr/bin/unshare --mount --net --pid --mount-proc \
     --propagation private --fork --kill-child=KILL \
     /usr/bin/env -i PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC HOME=/nonexistent \
     /usr/bin/bash --noprofile --norc -p "$S22_EXECUTOR" --namespace-child \
     "$S22_OUTER_MOUNT_NAMESPACE" "$S22_OUTER_MOUNT_NAMESPACE_IDENTITY" \
     "$S22_OUTER_NETWORK_NAMESPACE" "$S22_OUTER_NETWORK_NAMESPACE_IDENTITY" \
     "$S22_OUTER_PID_NAMESPACE" "$S22_OUTER_PID_NAMESPACE_IDENTITY" \
     "$S22_STAGED_BUN_SOURCE" "$S22_STAGED_BUN_SOURCE_SHA256" \
     "$S22_STAGED_BUN_SOURCE_SIZE" "$S22_BOOTSTRAP_SUPERVISOR_IDENTITY" \
     "$S22_BOOTSTRAP_SUPERVISOR_PID"

   The inner timeout sends TERM after 1,500 seconds and KILL 30 seconds later. PID-namespace init and --kill-child=KILL prevent descendants from surviving as unrecorded host background processes; the post-exit namespace scans must still clear.

5. Inside the child, bind the fresh anchor backing directory over /etc/chorus/s22/m001, then remount that exact target ro,nosuid,nodev,noexec. Prove private mount propagation, a distinct PID namespace, a fresh /proc, and no non-loopback interface or IPv4/IPv6 default route. This proves the external INET path is absent; it does not claim that host filesystem-visible AF_UNIX endpoints have ceased to exist. Persist the namespace-entry receipt before compilation.

6. Run both candidate builds and require the exact 58-file native output set named by the approval-bound NATIVE_BUILDER_OUTPUT_NAMES array, its exact name-to-mode contract, and exact SHA256SUMS equality, plus the exact AOT output set and both AOT completion sentinels. Ordinary /usr/bin/umount is the only accepted cleanup; bare, lazy, and forced unmounts are forbidden. Failed or truncated find output is fatal.

   The native build output directory contains truthful precommit evidence only. On success, the native build driver emits exactly Built reviewed S22 launcher bundle at <LOGICAL_NATIVE_OUTPUT>\n; it does not emit a supervisor publication result or attest an inotify drain, recursive post-rename rehash, or parent-directory fsync. The canonical executor captures that exact stdout in its immutable step-output envelope, then independently reopens the exact 58-file set, verifies modes and SHA256SUMS, syncs every output, retains the file leases, drains its recursive change ledger, and incorporates the native result into the complete package precommit receipt.

   Only after the executor succeeds and the complete package is published does the static bootstrap supervisor create the approval-bound fresh recovery-private bootstrap-supervisor-publication-result.json, outside the candidate output. It creates the file exclusively at mode 0400, binds the complete package precommit receipt and published package-root identity, data-syncs the file, and syncs its recovery directory. Ephemeral terminal output never proves completion.

   {
     "schema_version": "chorus.s22-bootstrap-supervisor-publication-result/1",
     "basename": "bootstrap-supervisor-publication-result.json",
     "mode": "0400",
     "exact_keys": [
       "schema_version",
       "state",
       "output_path",
       "output_directory_device",
       "output_directory_inode",
       "receipt_sha256",
       "receipt_size_bytes",
       "artifact_leases_retained_through_verification",
       "inotify_recursive_ledger_clean",
       "parent_fsynced_after_rename",
       "post_rename_recursive_identity_hash_verified"
     ],
     "state": "postcommit_verified",
     "directory_identity_encoding": "canonical-unsigned-decimal-string-uint64/1",
     "true_assertions": [
       "artifact_leases_retained_through_verification",
       "inotify_recursive_ledger_clean",
       "parent_fsynced_after_rename",
       "post_rename_recursive_identity_hash_verified"
     ],
     "capture": ["exclusive", "canonical-newline-terminated", "file-fsynced", "parent-fsynced", "outside-candidate"],
     "required_bindings": ["precommit-receipt-sha256", "precommit-receipt-size-bytes", "output-path", "output-directory-device", "output-directory-inode"]
   }

   Parse that durable file as exact canonical JSON and require its output path and output directory device/inode canonical unsigned decimal-string values to equal the published package root as exact uint64 identities. Require its receipt SHA-256 and size to equal the immutable precommit build receipt and all four assertions to be true. The parser-owned root terminal result binds the durable supervisor result together with the copy log, transport receipt, foundation descriptor, and package precommit receipt; the earlier foundation descriptor cannot cyclically attest this later postcommit publication. Native completion follows this exact order:

   ["builder-exit-zero", "exact-step-stdout-verified", "executor-output-rehash-and-sync", "package-precommit-receipt", "package-published", "supervisor-result-published", "root-terminal-verified"]

7. After the supervised child has exited, when the namespace-entry receipt exists, all three scans are mandatory across mount, network, and PID namespaces and each must prove both its recorded name and device:inode identity absent from /proc. Receipt absence is recorded, performs no invented scans, and can never be a successful run. Then prove the original host anchor is byte- and metadata-identical to preflight, and separately prove all three host namespace names and device:inode identities are identical to preflight. After those mandatory outer checks, the attempt receipt is published after every waited supervision status whose mandatory outer checks complete, whether zero or nonzero. It records that status and the outer executor PID and makes success-only claims only when the status is zero. The foundation descriptor is published only after a zero waited supervision status, an observed namespace-entry receipt, all three clear scans, and every candidate postcondition.

Candidate construction now has two separate approvals. First create one fresh high-risk host.s22_foundation_candidate_prepare gate while the candidate target is absent. Its canonical request binds the candidate input and parent, exact operator UID/GID, reviewed coordinator/renderer/launcher/parser closure, the fixed provisional then final order, bounded phase/session budgets, and local-only result. One accepted execution token and one durable attempt may start exactly one fixed-descriptor broker session. The broker creates one fresh empty mode-0700 operator-owned target, hands it to the coordinator on FD 4, and serves exactly provisional, final, then complete; it is never resumed or dispatched twice.

["gate", "begin-attested", "dispatch-fenced", "provisional", "final", "complete", "launcher-receipt", "manifest-v2", "approval-v5", "root-result"]

Each phase retains its launch plan, two render receipts v2, and one launcher phase receipt. Only live descriptor, pidfd, namespace-disappearance, held-file, and peer-EOF validation may produce the private cleanup authority; parsing JSON never does. The final launcher receipt binds both ordered phase receipts and the shared cleanup semantic commitment. chorus.s22-foundation-recovery-candidate-manifest/2 is written only after that final receipt and binds the prepare request, both phase receipts, launcher receipt, cleanup commitment, the future root-result contract from the prepare request, and exact six-artifact bootstrap plan. It also binds the exact supervisor, action-parser, root-preflight, and local-only effects contracts. The chorus.s22-package-inode-custody-manifest/1 is the canonical execution anchor for the candidate’s retained files and directories. It records the sealed root-preflight evidence and the complete private inventory captured before approval publication.

The manifest and custody inventory carry the same chorus.s22-producer-semantic-comparison/1 record. Its digest normalizes fresh candidate paths so independent candidates can be compared, but the record explicitly has execution_authority: false; it never authorizes execution. Before publishing an intent or starting the supervised child, the recovery parser holds every custody file and directory, reconciles each descriptor with its visible no-follow pathname, parses the approval-bound build and sealed root-preflight receipts, and repeats those measurements at the pre-intent, pre-child, and post-child checkpoints.

The recovery approval is then rendered as chorus.s22-foundation-recovery-approval/5. It retains all build fields from v4 and adds exact descriptors for manifest v2, the prepare request, both phase receipts, the final launcher receipt, the cleanup semantic commitment, and the exact root-owned prepare result contract. The exclusive mode-0600 approval write, including its parent-directory fsync, is the final successful operator mutation. After the broker and coordinator exit, the prepare action parser publishes that contracted mode-0400, root-owned terminal result. It binds the completed broker result and measured launcher-receipt fact to the prepare action, campaign, request digest, and execution attempt. The later recovery action parser must hold and validate this root result before its first action-specific mutation. A test transport can therefore render draft-shaped candidate bytes, but cannot make them executable without the matching root-owned terminal result. Manifest v1, approval v4, and render-receipt v1 are rejected on this path; old or partial evidence is retained in quarantine and is never rewritten or migrated.

Only after independent review of that completed v5 candidate may a second high-risk host.s22_foundation_candidate_build gate be opened. Its v5 payload separately binds the plan’s identity, path, SHA-256, size, and mode plus exactly six descriptors, all additional approval evidence, the exact namespace identities and 28-element argv, the nine-entry supervisor vector, the stage FD-map/count/digest, the parent-FD-only copy and the exclusive chorus.s22-bootstrap-stage-fd-copy-log/1 and chorus.s22-bootstrap-stage-fd-transport/1 output contracts, the expected local output paths, the exclusive durable chorus.s22-bootstrap-supervisor-publication-result/1 capture contract, and explicit execution lifetimes: approval_execution_lease_seconds is 3600 and approval_execution_token_ttl_seconds is 7200. Its allowed result is local candidate construction only; deployment, service start, host-trust installation, broker invocation, seed/export, external network access, and production traffic remain false.

An approved status is not execution authority by itself. After final non-privileged remeasurement and typed operator confirmation, use the public file-based approval protocol approvals execution begin with one stable attempt ID, the owner-only approval response, and the independently derived action fingerprint. Continue only when the response is accepted or resumed and contains execution_authorized: true. Within that authorized attempt, first prove from durable state that root launch has never begun, then rerun the exact current-boot root preflight. Publish and data-sync one exclusive owner-only launch-start record binding the gate, fingerprint, attempt ID, returned revision, complete verified package, exact argv, and fresh preflight. Only then make the 28-element sudo launch. Once launch-start exists, root launch may have begun: never issue sudo again for that attempt, even after a reboot or missing client response. Reconcile the retained launch record and root receipts, then call approvals execution finish with the same gate, capability, attempt ID, fingerprint, revision, and exact terminal outcome.

The local recovery order is exact:

["begin", "authorized", "preflight", "launch-start", "sudo", "reconcile", "finish"]

The approval response containing the one-time capability must be a canonical absolute, owner-only mode-0600 regular file. The attempt ID is stable only for this exact gate and action fingerprint. The independently recomputed expected fingerprint, not the displayed gate status, is passed to both public execution commands. accepted and resumed are authorizing only when execution_authorized is exactly true and launch-start is still absent. Every item in this list is non-authorizing:

[
  "approved-status-only",
  "pending",
  "denied",
  "cancelled",
  "accepted-without-execution_authorized",
  "resumed-after-launch-start",
  "observed_in_flight",
  "observed_completed",
  "expired",
  "conflict",
  "malformed-begin-response",
  "finish-response"
]

An in-flight, completed, expired, conflicting, malformed, or other non-authorizing observation never starts or repeats host work; reconcile it instead. Failure or ambiguity retains the entire attempt and requires a fresh package path, attempt ID, and gate for any new launch.

Only a zero waited supervision status may publish the fresh foundation descriptor, and that descriptor must bind both namespace receipts. Any nonzero status permanently abandons the fresh bootstrap and foundation paths. This recovery authorizes candidate construction only. Even after a zero waited supervision status, the recovered descriptor and build outputs are candidate evidence only. Because the old fixed host anchor stays immutable, the recovered candidate cannot continue to same-host installation, trust publication, service start, or broker invocation. Installation requires either a clean destination host with no conflicting fixed anchor or a separately designed and approved anchor epoch; that transition is outside this procedure. This recovery does not authorize a production deployment, and this audit performs none. Any live deployment requires a separate production approval after the recovered candidate and its complete evidence have been independently reviewed.

Only the ordinary first-attempt path on a host without a conflicting fixed anchor may continue in order through seed custody, public export, v2 plan construction, and phase one below. A namespace-recovery path stops after preserving its candidate evidence. Phase one deliberately accepts future paths for the terminal intent and request without reading them. It produces the exact broker-runtime-policy.json bytes that campaign trust must sign before the campaign. Do not postpone phase one until final A/B.

Transition the recovered candidate onto a clean destination

A namespace-recovered candidate may continue only on a distinct clean host. Transfer the unchanged recovered package to that destination, then build and replay its transport manifest at the final canonical destination path. The source and destination boot IDs must differ. The mount, network, and PID namespace identities must differ as well; one changed member is not sufficient. The destination observation must prove the fixed anchor, foundation roots, journal, receipt, signing seed, and foundation-attestor policy are all absent before the gate is opened.

: "${RECOVERED_PACKAGE:?canonical transferred recovered-package directory}"
: "${DESTINATION_LOADER:?canonical destination ELF loader}"
: "${DESTINATION_OBSERVATION:?fresh owner-only observation path}"
: "${S22_BUILDER_BUN:?reviewed absolute Bun used without root}"
: "${S22_BUILDER:?reviewed absolute builder closure}"

"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  build-transport \
  --package-directory "$RECOVERED_PACKAGE"
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  verify-transport \
  --transport-manifest "$RECOVERED_PACKAGE/transport-manifest.json"

Provision the fixed launcher under a separate action

The fixed root launcher is a prerequisite, not part of the foundation transition. Provision it once through its own high-risk action before creating the transition action. That action truthfully permits only installation of the exact launcher bytes at the fixed path. It does not permit the foundation transition, seed generation, service start, broker invocation, network access, traffic, or deployment. An existing destination or retained candidate is a permanent no-replay result.

The launcher-provision order is exact:

["nonce-v2", "build-v2", "host-proof-v2", "render-v2", "fingerprint-v2", "gate", "begin-attested", "dispatch-v2", "reconcile-v2", "finish"]

Prepare the action and open the gate without root. The approval command is deliberately a separate human step; do not place it in an unattended script. The generic root execution bootstrap, its fixed build tool, the native approval-begin verifier and key set are externally established prerequisites. The launcher interface consumes those authorities read-only. Its supported nonce-bound host-proof producer builds or reconciles the static native probe inside the nonce-derived owner state, measures the current host, and emits one canonical proof authority. The later privileged dispatch executes that exact native proof before mutation. The producer cannot install the launcher or perform any other host mutation.

: "${S22_BUILDER_BUN_SHA256:?reviewed Bun digest}"
: "${S22_CLI_SHA256:?reviewed CLI entrypoint digest}"
: "${S22_LAUNCHER_PROVISION_TOOL_SHA256:?reviewed launcher-provision tool digest}"
: "${S22_ROOT_LAUNCHER_SOURCE_SHA256:?reviewed static launcher source digest}"
: "${S22_APPROVAL_BEGIN_VERIFIER:?absolute pinned native begin verifier}"
: "${S22_APPROVAL_BEGIN_KEYS:?one or two sorted comma-separated public-key paths}"
: "${TRANSITION_PARENT:?fresh canonical owner-only mode-0700 state directory}"
: "${APPROVER_IDENTITY:?explicit human approver identity}"

set -euo pipefail
umask 077
readonly S22_LAUNCHER_PROVISION_TOOL="$S22_BUILDER/scripts/s22-clean-destination-launcher-provision.ts"
readonly S22_ROOT_LAUNCHER_SOURCE="$S22_BUILDER/scripts/s22-clean-destination-executor.sh"
readonly S22_LAUNCHER_BUILD_BUN=/usr/local/bin/bun
readonly S22_ROOT_EXECUTION_BOOTSTRAP_RECEIPT=/etc/protoworks/root-execution-bootstrap/v1/receipt.json
readonly S22_ROOT_EXECUTION_BOOTSTRAP_KEY=/etc/protoworks/root-execution-bootstrap/v1/ed25519.spki
readonly S22_ROOT_LAUNCHER=/usr/local/libexec/chorus/s22/m001/clean-destination-executor
readonly S22_ROOT_LAUNCHER_CANDIDATE=/usr/local/libexec/chorus/s22/m001/.clean-destination-executor.provisioning
readonly S22_ROOT_LAUNCHER_PROOF=/usr/local/libexec/chorus/s22/m001/clean-destination-launcher-provision-proof.json
readonly S22_ROOT_LAUNCHER_PROOF_CANDIDATE=/usr/local/libexec/chorus/s22/m001/.clean-destination-launcher-provision-proof.provisioning

test "$(/usr/bin/realpath -e -- "$S22_BUILDER")" = "$S22_BUILDER"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$S22_BUILDER")" = "555 0 0"
for authority in \
  "$S22_BUILDER_BUN:$S22_BUILDER_BUN_SHA256:555-or-755" \
  "$S22_BUILDER/packages/cli/src/index.ts:$S22_CLI_SHA256:444" \
  "$S22_LAUNCHER_PROVISION_TOOL:$S22_LAUNCHER_PROVISION_TOOL_SHA256:444" \
  "$S22_ROOT_LAUNCHER_SOURCE:$S22_ROOT_LAUNCHER_SOURCE_SHA256:555"
do
  authority_path=${authority%%:*}
  authority_rest=${authority#*:}
  authority_sha=${authority_rest%%:*}
  authority_mode=${authority_rest##*:}
  test "$(/usr/bin/realpath -e -- "$authority_path")" = "$authority_path"
  test -f "$authority_path" -a ! -L "$authority_path"
  observed=$(/usr/bin/stat -Lc '%a %u %g %h' -- "$authority_path")
  case $authority_mode in
    555-or-755) [[ $observed == "555 0 0 1" || $observed == "755 0 0 1" ]] ;;
    *) test "$observed" = "$authority_mode 0 0 1" ;;
  esac
  observed_sha=$(/usr/bin/sha256sum -- "$authority_path")
  test "${observed_sha%% *}" = "$authority_sha"
done

: "${LAUNCHER_STATE:?fresh canonical launcher-only mode-0700 state directory}"
test "$LAUNCHER_STATE" != "$TRANSITION_PARENT"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$LAUNCHER_STATE")" = \
  "700 $(/usr/bin/id -u) $(/usr/bin/id -g)"
: "${LAUNCHER_APPROVAL_ATTEMPT_ID:?stable attempt for this launcher action only}"
: "${LAUNCHER_RECONCILIATION_ID:?fresh lowercase identifier for this read-only observation}"
[[ $LAUNCHER_RECONCILIATION_ID =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]]
LAUNCHER_ACTION_NONCE_FILE=$LAUNCHER_STATE/action-nonce.txt
LAUNCHER_BUILD_RESPONSE=$LAUNCHER_STATE/parser-build-response.json
LAUNCHER_RENDER_RESPONSE=$LAUNCHER_STATE/rendered-approval.json
LAUNCHER_GATE_REQUEST=$LAUNCHER_STATE/gate-request.json
LAUNCHER_GATE_CREATE=$LAUNCHER_STATE/gate-create.json
LAUNCHER_APPROVAL_RESPONSE=$LAUNCHER_STATE/approval-response.json
LAUNCHER_BEGIN_RESPONSE=$LAUNCHER_STATE/begin-response.json
LAUNCHER_DISPATCH_RESPONSE=$LAUNCHER_STATE/dispatch-response.json
LAUNCHER_RECONCILIATION_RESPONSE=$LAUNCHER_STATE/reconciliation-response-$LAUNCHER_RECONCILIATION_ID.json
LAUNCHER_FINISH_RESPONSE=$LAUNCHER_STATE/finish-response.json

LAUNCHER_ACTION_NONCE=$(
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" nonce-v2
)
[[ $LAUNCHER_ACTION_NONCE =~ ^[0-9a-f]{32}$ ]]
( set -o noclobber
  /usr/bin/printf '%s\n' "$LAUNCHER_ACTION_NONCE" >"$LAUNCHER_ACTION_NONCE_FILE"
)
/usr/bin/sync -f "$LAUNCHER_ACTION_NONCE_FILE"
/usr/bin/sync -f "$LAUNCHER_STATE"

LAUNCHER_OWNER_STATE="/run/user/$(/usr/bin/id -u)/chorus/s22-clean-destination-launcher-provision/$LAUNCHER_ACTION_NONCE"
LAUNCHER_PARSER_BUILD_RECEIPT=$LAUNCHER_OWNER_STATE/action-parser-build.json
LAUNCHER_HOST_PROOF_RESPONSE=$LAUNCHER_OWNER_STATE/.initial-host-proof.response
S22_INITIAL_HOST_PROOF=$LAUNCHER_OWNER_STATE/initial-host-proof.json
LAUNCHER_ACTION=$LAUNCHER_OWNER_STATE/approval.json
LAUNCHER_APPROVAL_ATTESTATION=$LAUNCHER_OWNER_STATE/approval-begin-attestation.json
LAUNCHER_OPERATOR_FENCE=$LAUNCHER_OWNER_STATE/operator-launch-fence.json
test ! -e "$LAUNCHER_OWNER_STATE" -a ! -L "$LAUNCHER_OWNER_STATE"
test "$(/usr/bin/realpath -e -- "$S22_LAUNCHER_BUILD_BUN")" = \
  "$S22_LAUNCHER_BUILD_BUN"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$S22_LAUNCHER_BUILD_BUN")" = \
  "555 0 0 1"

# build-v2 creates the exact nonce-derived owner state, copies the bounded source
# closure, performs two clean byte-identical compiled-parser builds, and publishes
# the canonical parser receipt itself. Captured stdout must equal that publication.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" build-v2 \
    "$S22_BUILDER" "$S22_LAUNCHER_BUILD_BUN" "$LAUNCHER_ACTION_NONCE" \
    >"$LAUNCHER_BUILD_RESPONSE"
)
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$LAUNCHER_OWNER_STATE")" = \
  "700 $(/usr/bin/id -u) $(/usr/bin/id -g)"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_PARSER_BUILD_RECEIPT")" = \
  "400 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
test "$(/usr/bin/sha256sum -- "$LAUNCHER_PARSER_BUILD_RECEIPT" | cut -d' ' -f1)" = \
  "$(/usr/bin/sha256sum -- "$LAUNCHER_BUILD_RESPONSE" | cut -d' ' -f1)"

# host-proof-v2 is the supported local producer. It builds or reconciles the exact
# native probe pair in LAUNCHER_OWNER_STATE, binds the current host, and emits only
# canonical JSON. Privileged dispatch performs the native proof. Keep incomplete stdout
# under a non-authoritative sibling name;
# publish the final proof with one no-replace link only after the command succeeds.
test ! -e "$LAUNCHER_HOST_PROOF_RESPONSE" -a ! -L "$LAUNCHER_HOST_PROOF_RESPONSE"
test ! -e "$S22_INITIAL_HOST_PROOF" -a ! -L "$S22_INITIAL_HOST_PROOF"
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" host-proof-v2 \
    "$LAUNCHER_ACTION_NONCE" >"$LAUNCHER_HOST_PROOF_RESPONSE"
)
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_HOST_PROOF_RESPONSE")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
/usr/bin/ln -- "$LAUNCHER_HOST_PROOF_RESPONSE" "$S22_INITIAL_HOST_PROOF"
/usr/bin/sync -f "$S22_INITIAL_HOST_PROOF"
/usr/bin/sync -f "$LAUNCHER_OWNER_STATE"
/usr/bin/rm -- "$LAUNCHER_HOST_PROOF_RESPONSE"
/usr/bin/sync -f "$LAUNCHER_OWNER_STATE"
test "$(/usr/bin/realpath -e -- "$S22_INITIAL_HOST_PROOF")" = \
  "$S22_INITIAL_HOST_PROOF"
test -f "$S22_INITIAL_HOST_PROOF" -a ! -L "$S22_INITIAL_HOST_PROOF"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$S22_INITIAL_HOST_PROOF")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
/usr/bin/jq -e \
  --arg nonce "$LAUNCHER_ACTION_NONCE" '
    .schema_version == "chorus.s22-initial-host-namespace-proof-authority/1"
    and .action_nonce == $nonce
    and .host_identity.initial_full_identity_maps == true
    and .native_absolute_proof_required == true
    and .exact_machine_identity_required == true
  ' "$S22_INITIAL_HOST_PROOF" >/dev/null

# render-v2 requires the final approval path to be absent while it derives the action.
# Capture to a fresh owner-only file, then publish the final path with an atomic
# no-replace link and retire the temporary name before opening the gate.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" render-v2 \
    "$S22_ROOT_LAUNCHER_SOURCE" "$S22_INITIAL_HOST_PROOF" \
    "$LAUNCHER_PARSER_BUILD_RECEIPT" "$S22_APPROVAL_BEGIN_VERIFIER" \
    "$S22_APPROVAL_BEGIN_KEYS" "$S22_ROOT_EXECUTION_BOOTSTRAP_RECEIPT" \
    "$S22_ROOT_EXECUTION_BOOTSTRAP_KEY" "$LAUNCHER_ACTION_NONCE" \
    >"$LAUNCHER_RENDER_RESPONSE"
)
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_RENDER_RESPONSE")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
/usr/bin/ln -- "$LAUNCHER_RENDER_RESPONSE" "$LAUNCHER_ACTION"
/usr/bin/sync -f "$LAUNCHER_ACTION"
/usr/bin/sync -f "$LAUNCHER_OWNER_STATE"
/usr/bin/rm -- "$LAUNCHER_RENDER_RESPONSE"
/usr/bin/sync -f "$LAUNCHER_STATE"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_ACTION")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"

/usr/bin/jq -e \
  --arg nonce "$LAUNCHER_ACTION_NONCE" \
  --arg approval "$LAUNCHER_ACTION" \
  --arg attestation "$LAUNCHER_APPROVAL_ATTESTATION" \
  --arg fence "$LAUNCHER_OPERATOR_FENCE" \
  --arg proof "$S22_ROOT_LAUNCHER_PROOF" \
  --arg proof_candidate "$S22_ROOT_LAUNCHER_PROOF_CANDIDATE" \
  --arg parser_build "$LAUNCHER_PARSER_BUILD_RECEIPT" '
  .schema_version == "chorus.s22-clean-destination-launcher-provision-approval/2"
  and .action_nonce == $nonce
  and .initial_host_namespace_proof.action_nonce == $nonce
  and .execution_protocol.files.approval_payload.path == $approval
  and .execution_protocol.files.approval_begin_attestation.path == $attestation
  and .execution_protocol.files.operator_launch_fence.path == $fence
  and .execution_protocol.files.action_parser_build_receipt.path == $parser_build
  and .proof_receipt.path == $proof
  and .proof_receipt.candidate_path == $proof_candidate
  and .host_identity.initial_full_identity_maps == true
  and .host_identity.uid_map.text == "         0          0 4294967295"
  and .host_identity.gid_map.text == "         0          0 4294967295"
  and (.host_identity.boot_id | type == "string")
  and ([.host_identity.namespaces.user, .host_identity.namespaces.mount,
        .host_identity.namespaces.network, .host_identity.namespaces.pid,
        .host_identity.namespaces.pid_for_children]
       | all(.name | type == "string"))
  and .expected_result.native_absolute_proof_verified == true
  and .expected_result.source_consumed_from == "approval-inline-base64"
  and .execution_protocol.reconciliation_only_after_fence == true
  and .allowed_result.foundation_transition == false
  and .allowed_result.production_deploy == false
' "$LAUNCHER_ACTION" >/dev/null
LAUNCHER_EXPECTED_FINGERPRINT=$(
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" fingerprint-v2 \
    "$LAUNCHER_ACTION"
)
[[ $LAUNCHER_EXPECTED_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]

( set -o noclobber
  /usr/bin/jq -nS \
    --arg type host.s22_clean_destination_launcher_provision \
    --arg summary "Install exactly one fixed S22 clean-destination launcher; no transition or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$LAUNCHER_ACTION" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "high",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    ' >"$LAUNCHER_GATE_REQUEST"
)
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" approvals create \
    --profile inu --from-file "$LAUNCHER_GATE_REQUEST" --json \
    >"$LAUNCHER_GATE_CREATE"
)
/usr/bin/jq -e \
  --arg type host.s22_clean_destination_launcher_provision \
  --arg fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
  --slurpfile action "$LAUNCHER_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and .status == "pending"
  ' "$LAUNCHER_GATE_CREATE" >/dev/null
LAUNCHER_APPROVAL_GATE_ID=$(/usr/bin/jq -er '.id' "$LAUNCHER_GATE_CREATE")

After inspecting the exact action, Inu captures the winning response with this command:

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" approvals approve \
    "$LAUNCHER_APPROVAL_GATE_ID" --profile inu \
    --note "I authorize exactly this fixed launcher installation, with no foundation transition or deployment." \
    --json >"$LAUNCHER_APPROVAL_RESPONSE"
)
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_APPROVAL_RESPONSE")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"

Only then consume the capability and require the signed begin artifact at the exact approval-bound path. dispatch-v2 performs the one permitted operator-fence publication and privileged launch internally. Once that command starts, wait for it to stop and never repeat, rerun, or replay the privileged action; after any success, failure, lost output, or interruption, reconcile-v2 is the only permitted next launcher command.

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" \
    approvals execution begin --profile inu \
    --attempt-id "$LAUNCHER_APPROVAL_ATTEMPT_ID" \
    --approval-response "$LAUNCHER_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
    --attestation-output "$LAUNCHER_APPROVAL_ATTESTATION" \
    --json >"$LAUNCHER_BEGIN_RESPONSE"
)
/usr/bin/jq -e \
  --arg gate "$LAUNCHER_APPROVAL_GATE_ID" \
  --arg attempt "$LAUNCHER_APPROVAL_ATTEMPT_ID" \
  --arg fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" '
    (.status == "accepted" or .status == "resumed")
    and .execution_authorized == true
    and .attempt.gate_id == $gate
    and .attempt.attempt_id == $attempt
    and .attempt.request_fingerprint == $fingerprint
    and .attempt.state == "accepted"
    and (.attempt.revision | type == "number" and floor == . and . >= 1)
    and (.attempt.accepted_at | type == "string")
    and (.attempt.lease_expires_at | type == "string")
    and (.attempt.completed_at == null)
    and (.attempt.last_error == null)
  ' "$LAUNCHER_BEGIN_RESPONSE" >/dev/null
LAUNCHER_APPROVAL_REVISION=$(/usr/bin/jq -er '.attempt.revision' "$LAUNCHER_BEGIN_RESPONSE")
test "$(/usr/bin/realpath -e -- "$LAUNCHER_APPROVAL_ATTESTATION")" = \
  "$LAUNCHER_APPROVAL_ATTESTATION"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$LAUNCHER_APPROVAL_ATTESTATION")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"

# dispatch-v2 owns both the durable operator fence and the one privileged launch.
# Its process status and captured stdout are evidence only, never replay authority.
set +e
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" dispatch-v2 \
    "$LAUNCHER_ACTION" "$LAUNCHER_APPROVAL_ATTESTATION" \
    >"$LAUNCHER_DISPATCH_RESPONSE"
)
LAUNCHER_DISPATCH_STATUS=$?
set -e
if [[ $LAUNCHER_DISPATCH_STATUS == 0 ]]; then
  /usr/bin/jq -e \
    --arg fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
    --arg fence "$LAUNCHER_OPERATOR_FENCE" '
      .schema_version == "chorus.s22-clean-destination-launcher-provision-dispatch/2"
      and .state == "postcommit_verified"
      and .approval_fingerprint == $fingerprint
      and .operator_fence.path == $fence
      and .privileged_launch_count == 1
      and .read_only_after_operator_fence == true
      and .privileged_replay == false
      and .production_deploy == false
      and .service_start == false
    ' "$LAUNCHER_DISPATCH_RESPONSE" >/dev/null
fi

# Process status and captured output are evidence only. After the process is known
# stopped, make the exact retained state authoritative through read-only v2
# reconciliation. Retain an interrupted response, choose a fresh
# LAUNCHER_RECONCILIATION_ID, and repeat only this read-only command.
set +e
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_LAUNCHER_PROVISION_TOOL" reconcile-v2 \
    "$LAUNCHER_ACTION" "$LAUNCHER_APPROVAL_ATTESTATION" \
    >"$LAUNCHER_RECONCILIATION_RESPONSE"
)
LAUNCHER_RECONCILIATION_STATUS=$?
set -e

if [[ $LAUNCHER_RECONCILIATION_STATUS == 0 ]] \
  && /usr/bin/jq -e \
    --arg fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
    --arg destination "$S22_ROOT_LAUNCHER" \
    --arg proof "$S22_ROOT_LAUNCHER_PROOF" \
    --arg fence "$LAUNCHER_OPERATOR_FENCE" '
    .schema_version == "chorus.s22-clean-destination-launcher-provision-reconciliation/2"
    and .action_type == "host.s22_clean_destination_launcher_provision"
    and .state == "postcommit_verified"
    and .phase == "receipt"
    and .approval_fingerprint == $fingerprint
    and .operator_fence.path == $fence
    and .receipt != null
    and .result.destination.path == $destination
    and .result.proof_receipt.path == $proof
    and .result.source_consumed_from == "approval-inline-base64"
    and .result.native_absolute_proof_verified == true
    and .result.foundation_transition == false
    and .current_host_verified == true
    and .terminal == true
    and .read_only == true
    and .privileged_replay == false
    and .production_deploy == false
    and .service_start == false
  ' "$LAUNCHER_RECONCILIATION_RESPONSE" >/dev/null
then
  LAUNCHER_OUTCOME=succeeded
  LAUNCHER_EXPECTED_STATE=succeeded
  LAUNCHER_ERROR=
  LAUNCHER_ERROR_ARGS=()
else
  LAUNCHER_OUTCOME=terminal_failure
  LAUNCHER_EXPECTED_STATE=failed
  LAUNCHER_ERROR=launcher_provision_not_verified
  LAUNCHER_ERROR_ARGS=(--error "$LAUNCHER_ERROR")
fi

( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" \
    approvals execution finish --profile inu \
    --attempt-id "$LAUNCHER_APPROVAL_ATTEMPT_ID" \
    --approval-response "$LAUNCHER_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
    --revision "$LAUNCHER_APPROVAL_REVISION" --outcome "$LAUNCHER_OUTCOME" \
    "${LAUNCHER_ERROR_ARGS[@]}" --json >"$LAUNCHER_FINISH_RESPONSE"
)
/usr/bin/jq -e \
  --arg gate "$LAUNCHER_APPROVAL_GATE_ID" \
  --arg attempt "$LAUNCHER_APPROVAL_ATTEMPT_ID" \
  --arg fingerprint "$LAUNCHER_EXPECTED_FINGERPRINT" \
  --arg state "$LAUNCHER_EXPECTED_STATE" \
  --arg error "$LAUNCHER_ERROR" \
  --argjson revision "$LAUNCHER_APPROVAL_REVISION" '
    (.status == "finished" or .status == "idempotent")
    and .execution_authorized == false
    and .attempt.gate_id == $gate
    and .attempt.attempt_id == $attempt
    and .attempt.request_fingerprint == $fingerprint
    and .attempt.state == $state
    and .attempt.revision == ($revision + 1)
    and (.attempt.completed_at | type == "string")
    and (if $state == "succeeded" then .attempt.last_error == null
         else .attempt.last_error == $error end)
  ' "$LAUNCHER_FINISH_RESPONSE" >/dev/null
test "$LAUNCHER_EXPECTED_STATE" = succeeded
test ! -e "$S22_ROOT_LAUNCHER_CANDIDATE" -a ! -L "$S22_ROOT_LAUNCHER_CANDIDATE"

After the fixed launcher is proven installed, make a new destination observation. This observation is the one bound into the separate foundation-transition action.

"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  observe-destination --loader "$DESTINATION_LOADER" \
  --output "$DESTINATION_OBSERVATION"
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  verify-observation --destination-observation "$DESTINATION_OBSERVATION"

Open one high-risk approval gate that binds the exact transport-manifest and observation bytes, their file identities, the reviewed builder and fixed root launcher, the dedicated no-login account tuple, all fresh package/fence/root-custody paths, and the complete command below. Capture the approval response, including its one-time capability, in one canonical absolute owner-only mode-0600 regular file. The status approved alone never launches anything. Independently recompute the expected action fingerprint from the exact gate payload and keep one stable attempt ID for that gate, fingerprint, and package only.

The clean-destination order is exact and separate from the local recovery order:

["begin", "authorized", "preflight", "launch-start", "sudo-transition", "sudo-observe", "reconcile", "finish"]

Use approvals execution begin first. Continue only for accepted or resumed with execution_authorized exactly true and only when durable state proves this attempt never reached launch-start. Record the returned positive revision. Rerun transport and destination preflight, render and verify the inert owner-custodied package without root, and then publish the exclusive data-synced launch-start fence. The fence binds the exact package descriptor, plan and executor file facts, source package, destination boot ID, gate, fingerprint, stable attempt, and revision. From that instant root launch may have begun. Never invoke the mutating vector again for the same fence. After that process is known stopped, only its separately materialized, approval-bound observation vector may use sudo to publish the read-only reconciliation snapshot.

: "${S22_BUILDER_BUN:?reviewed absolute Bun used without root}"
: "${S22_BUILDER_BUN_SHA256:?gate-bound Bun digest}"
: "${S22_BUILDER:?reviewed absolute builder closure}"
: "${S22_CLI_SHA256:?gate-bound absolute CLI entrypoint digest}"
: "${S22_TRANSITION_TOOL_SHA256:?gate-bound transition tool digest}"
: "${S22_ROOT_LAUNCHER_SHA256:?gate-bound fixed-launcher digest}"
: "${S22_ROOT_LAUNCHER_SIZE:?gate-bound fixed-launcher size}"
: "${APPROVAL_ATTEMPT_ID:?stable attempt ID for this exact action}"
: "${ROOT_OBSERVATION_ID:?fresh lowercase identifier for this root read-only observation}"
: "${TRANSITION_RECONCILIATION_ID:?fresh lowercase identifier for this non-root reconciliation}"
: "${TRANSITION_PARENT:?fresh canonical owner-only state directory}"
: "${APPROVER_IDENTITY:?explicit human approver identity}"
: "${ACCOUNT_NAME:?fresh dedicated no-login account name}"
: "${ACCOUNT_UID:?fresh dedicated UID}"
: "${ACCOUNT_GID:?fresh dedicated GID}"

set -euo pipefail
umask 077
[[ $ROOT_OBSERVATION_ID =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]]
[[ $TRANSITION_RECONCILIATION_ID =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]]
test "$(/usr/bin/realpath -e -- "$S22_BUILDER")" = "$S22_BUILDER"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$S22_BUILDER")" = "555 0 0"
for authority in \
  "$S22_BUILDER_BUN:$S22_BUILDER_BUN_SHA256:555-or-755" \
  "$S22_BUILDER/packages/cli/src/index.ts:$S22_CLI_SHA256:444" \
  "$S22_BUILDER/scripts/s22-clean-destination-transition.ts:$S22_TRANSITION_TOOL_SHA256:444" \
  "$S22_ROOT_LAUNCHER:$S22_ROOT_LAUNCHER_SHA256:555"
do
  authority_path=${authority%%:*}
  authority_rest=${authority#*:}
  authority_sha=${authority_rest%%:*}
  authority_mode=${authority_rest##*:}
  test "$(/usr/bin/realpath -e -- "$authority_path")" = "$authority_path"
  test -f "$authority_path" -a ! -L "$authority_path"
  observed=$(/usr/bin/stat -Lc '%a %u %g %h' -- "$authority_path")
  case $authority_mode in
    555-or-755) [[ $observed == "555 0 0 1" || $observed == "755 0 0 1" ]] ;;
    *) test "$observed" = "$authority_mode 0 0 1" ;;
  esac
  observed_sha=$(/usr/bin/sha256sum -- "$authority_path")
  test "${observed_sha%% *}" = "$authority_sha"
done
[[ $S22_ROOT_LAUNCHER_SIZE =~ ^[1-9][0-9]{0,6}$ ]]
test "$(/usr/bin/stat -Lc '%s %a %u %g %h' -- "$S22_ROOT_LAUNCHER")" = \
  "$S22_ROOT_LAUNCHER_SIZE 555 0 0 1"
test "$(/usr/bin/realpath -e -- "$TRANSITION_PARENT")" = "$TRANSITION_PARENT"
test -d "$TRANSITION_PARENT" -a ! -L "$TRANSITION_PARENT"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$TRANSITION_PARENT")" = \
  "700 $(/usr/bin/id -u) $(/usr/bin/id -g)"

TRANSITION_PACKAGE=$TRANSITION_PARENT/package
APPROVAL_ACTION=$TRANSITION_PARENT/approval-action.json
APPROVAL_RESPONSE=$TRANSITION_PARENT/approval-response.json
BEGIN_RESPONSE=$TRANSITION_PARENT/begin-response.json
APPROVAL_ATTESTATION=$TRANSITION_PARENT/approval-begin-attestation.json
FINISH_RESPONSE=$TRANSITION_PARENT/finish-response.json
GATE_REQUEST=$TRANSITION_PARENT/gate-request.json
GATE_CREATE_RESPONSE=$TRANSITION_PARENT/gate-create.json
LAUNCH_START=$TRANSITION_PARENT/launch-start.json
LAUNCH_PUBLICATION=$TRANSITION_PARENT/launch-publication.json
VERIFIED_LAUNCH_PUBLICATION=$TRANSITION_PARENT/verified-launch-publication.json
PRIVILEGED_ARGV_NUL=$TRANSITION_PARENT/privileged-argv.nul
RECONCILIATION_ARGV_NUL=$TRANSITION_PARENT/reconciliation-argv.nul
ROOT_RESULT=$TRANSITION_PARENT/root-result.txt
ROOT_RECONCILIATION_RESULT=$TRANSITION_PARENT/root-reconciliation-result-$ROOT_OBSERVATION_ID.txt
RECONCILIATION_RESPONSE=$TRANSITION_PARENT/reconciliation-$TRANSITION_RECONCILIATION_ID.json
APPROVAL_ATTESTATION_VERIFIER=/usr/local/libexec/chorus/s22/approval-begin-v1/verifier
APPROVAL_ATTESTATION_KEY_DIRECTORY=/etc/chorus/approval-execution-attestation/v1/keys
mapfile -t APPROVAL_ATTESTATION_KEYS < <(
  /usr/bin/find "$APPROVAL_ATTESTATION_KEY_DIRECTORY" -maxdepth 1 -type f \
    -name 'ed25519-sha256-*.spki' -printf '%p\n' | LC_ALL=C /usr/bin/sort
)
[[ ${#APPROVAL_ATTESTATION_KEYS[@]} -ge 1 \
  && ${#APPROVAL_ATTESTATION_KEYS[@]} -le 2 ]]
APPROVAL_ATTESTATION_KEYS_CSV=$(
  IFS=,
  printf '%s' "${APPROVAL_ATTESTATION_KEYS[*]}"
)
TRANSPORT_MANIFEST=$RECOVERED_PACKAGE/transport-manifest.json
test ! -e "$TRANSITION_PACKAGE" -a ! -L "$TRANSITION_PACKAGE"
test ! -e "$APPROVAL_ACTION" -a ! -L "$APPROVAL_ACTION"
test ! -e "$APPROVAL_RESPONSE" -a ! -L "$APPROVAL_RESPONSE"
test ! -e "$LAUNCH_START" -a ! -L "$LAUNCH_START"

"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  approval-payload \
  --transport-manifest "$TRANSPORT_MANIFEST" \
  --destination-observation "$DESTINATION_OBSERVATION" \
  --builder-closure-root "$S22_BUILDER" \
  --builder-bun "$S22_BUILDER_BUN" \
  --cli-entrypoint "$S22_BUILDER/packages/cli/src/index.ts" \
  --transition-tool "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  --fixed-launcher "$S22_ROOT_LAUNCHER" \
  --approval-attestation-verifier "$APPROVAL_ATTESTATION_VERIFIER" \
  --approval-attestation-keys "$APPROVAL_ATTESTATION_KEYS_CSV" \
  --transition-parent "$TRANSITION_PARENT" \
  --account-name "$ACCOUNT_NAME" --account-uid "$ACCOUNT_UID" \
  --account-gid "$ACCOUNT_GID" --account-home /nonexistent \
  --account-shell /usr/sbin/nologin --output "$APPROVAL_ACTION" >/dev/null
EXPECTED_ACTION_FINGERPRINT=$(
  "$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
    approval-fingerprint --approval-payload "$APPROVAL_ACTION"
)
[[ $EXPECTED_ACTION_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]

( set -o noclobber
  /usr/bin/jq -nS \
    --arg type host.s22_clean_destination_foundation_transition \
    --arg summary "Install one exact recovered S22 foundation on this clean destination; no service or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$APPROVAL_ACTION" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "high",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    ' >"$GATE_REQUEST"
)
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" approvals create \
    --profile inu --from-file "$GATE_REQUEST" --json >"$GATE_CREATE_RESPONSE"
)
/usr/bin/jq -e \
  --arg type host.s22_clean_destination_foundation_transition \
  --arg fingerprint "$EXPECTED_ACTION_FINGERPRINT" \
  --slurpfile action "$APPROVAL_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and .status == "pending"
  ' "$GATE_CREATE_RESPONSE" >/dev/null
APPROVAL_GATE_ID=$(/usr/bin/jq -er '.id' "$GATE_CREATE_RESPONSE")

# HUMAN CHECKPOINT: after reviewing APPROVAL_ACTION, Inu runs this command once.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" approvals approve \
    "$APPROVAL_GATE_ID" --profile inu \
    --note "I authorize exactly this clean-destination foundation transition, with no service start or deployment." \
    --json >"$APPROVAL_RESPONSE"
)
test "$(/usr/bin/realpath -e -- "$APPROVAL_RESPONSE")" = "$APPROVAL_RESPONSE"
test -f "$APPROVAL_RESPONSE" -a ! -L "$APPROVAL_RESPONSE"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$APPROVAL_RESPONSE")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"

# Public capability consumption. The output path is fresh and owner-only.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" \
    approvals execution begin \
    --profile inu \
    --attempt-id "$APPROVAL_ATTEMPT_ID" \
    --approval-response "$APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$EXPECTED_ACTION_FINGERPRINT" \
    --attestation-output "$APPROVAL_ATTESTATION" \
    --json >"$BEGIN_RESPONSE"
)
/usr/bin/jq -e \
  --arg gate "$APPROVAL_GATE_ID" \
  --arg attempt "$APPROVAL_ATTEMPT_ID" \
  --arg fingerprint "$EXPECTED_ACTION_FINGERPRINT" '
    (.status == "accepted" or .status == "resumed")
    and .execution_authorized == true
    and .attempt.gate_id == $gate
    and .attempt.attempt_id == $attempt
    and .attempt.request_fingerprint == $fingerprint
    and .attempt.state == "accepted"
    and (.attempt.revision | type == "number" and floor == . and . >= 1)
    and (.attempt.accepted_at | type == "string")
    and (.attempt.lease_expires_at | type == "string")
    and (.attempt.completed_at == null)
    and (.attempt.last_error == null)
  ' "$BEGIN_RESPONSE" >/dev/null
test "$(/usr/bin/realpath -e -- "$APPROVAL_ATTESTATION")" = \
  "$APPROVAL_ATTESTATION"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$APPROVAL_ATTESTATION")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
APPROVAL_REVISION=$(/usr/bin/jq -er '.attempt.revision' "$BEGIN_RESPONSE")

# Preflight and owner-custodied package construction remain non-privileged.
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  verify-transport --transport-manifest "$TRANSPORT_MANIFEST" >/dev/null
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
  verify-observation --destination-observation "$DESTINATION_OBSERVATION" >/dev/null
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" render \
  --transport-manifest "$TRANSPORT_MANIFEST" \
  --destination-observation "$DESTINATION_OBSERVATION" \
  --approval-payload "$APPROVAL_ACTION" \
  --approval-attestation "$APPROVAL_ATTESTATION" \
  --account-name "$ACCOUNT_NAME" --account-uid "$ACCOUNT_UID" \
  --account-gid "$ACCOUNT_GID" --account-home /nonexistent \
  --account-shell /usr/sbin/nologin --output-directory "$TRANSITION_PACKAGE" \
  >/dev/null
"$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" verify \
  --package-directory "$TRANSITION_PACKAGE" >/dev/null

# Durable launch fence. If this command creates LAUNCH_START but its output is lost,
# reconcile LAUNCH_START; never run this block or the mutating root vector again.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
    launch-start --path "$LAUNCH_START" \
    --package-directory "$TRANSITION_PACKAGE" \
    --approval-attestation "$APPROVAL_ATTESTATION" >"$LAUNCH_PUBLICATION"
)
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
    verify-launch-start --path "$LAUNCH_START" \
    --package-directory "$TRANSITION_PACKAGE" \
    --approval-attestation "$APPROVAL_ATTESTATION" \
    >"$VERIFIED_LAUNCH_PUBLICATION"
)
( set -o noclobber
  /usr/bin/jq -j '.privileged_argv[] | ., "\u0000"' \
    "$VERIFIED_LAUNCH_PUBLICATION" >"$PRIVILEGED_ARGV_NUL"
)
( set -o noclobber
  /usr/bin/jq -j '.reconciliation_argv[] | ., "\u0000"' \
    "$VERIFIED_LAUNCH_PUBLICATION" >"$RECONCILIATION_ARGV_NUL"
)
mapfile -d '' -t PRIVILEGED_ARGV <"$PRIVILEGED_ARGV_NUL"
mapfile -d '' -t ROOT_RECONCILIATION_ARGV <"$RECONCILIATION_ARGV_NUL"
test "${#PRIVILEGED_ARGV[@]}" -eq 48
test "${#ROOT_RECONCILIATION_ARGV[@]}" -eq 51
ROOT_RECONCILIATION_EVIDENCE_PREFIX=$(
  /usr/bin/jq -er '.paths.reconciliation_evidence_prefix' "$APPROVAL_ACTION"
)

# The only mutating root dispatch is the exact vector independently reconstructed from
# the approval-bound launch fence. Never recompose its flags in the operator shell.
set +e
( set -o noclobber
  "${PRIVILEGED_ARGV[@]}" >"$ROOT_RESULT"
)
ROOT_STATUS=$?
set -e

# Root transition dispatch has returned, so its process is known stopped. The second
# exact approved vector is observation-only: it cannot repeat the transition and may
# only publish the root-owned, mode-0444 evidence snapshot at the action-bound path.
# Each invocation adds the next bounded, approval-prefixed immutable observation. If its
# redirected output is interrupted, retain it, choose a fresh ROOT_OBSERVATION_ID for the
# local result file, and repeat only this read-only vector after every prior process is
# known stopped. It never replaces a prior observation.
set +e
( set -o noclobber
  "${ROOT_RECONCILIATION_ARGV[@]}" >"$ROOT_RECONCILIATION_RESULT"
)
ROOT_RECONCILIATION_STATUS=$?
set -e
ROOT_RECONCILIATION_EVIDENCE=
ROOT_RECONCILIATION_EVIDENCE_VALID=false
if [[ $ROOT_RECONCILIATION_STATUS == 0 ]] \
  && ROOT_RECONCILIATION_EVIDENCE=$(
    /usr/bin/jq -er '.evidence.path' "$ROOT_RECONCILIATION_RESULT"
  )
then
  ROOT_RECONCILIATION_EVIDENCE_SUFFIX=\
${ROOT_RECONCILIATION_EVIDENCE#"$ROOT_RECONCILIATION_EVIDENCE_PREFIX"}
  if test "$ROOT_RECONCILIATION_EVIDENCE_SUFFIX" != \
      "$ROOT_RECONCILIATION_EVIDENCE" \
    && [[ $ROOT_RECONCILIATION_EVIDENCE_SUFFIX =~ ^[0-9]{6}\.json$ ]] \
    && test -f "$ROOT_RECONCILIATION_EVIDENCE" \
    && test ! -L "$ROOT_RECONCILIATION_EVIDENCE"
  then
    ROOT_RECONCILIATION_EVIDENCE_VALID=true
  fi
fi

# Process statuses and redirected output are retained evidence, never authority.
# Success is determined only from the root-custodied snapshot and complete non-root,
# read-only semantic reconciliation. An interrupted response is retained and retried
# only with a fresh TRANSITION_RECONCILIATION_ID. If root observation failed or
# produced no valid immutable evidence path, skip semantic reconciliation and close
# the accepted attempt as a bounded terminal failure before returning nonzero.
RECONCILIATION_STATUS=1
if [[ $ROOT_RECONCILIATION_EVIDENCE_VALID == true ]]; then
  set +e
  ( set -o noclobber
    "$S22_BUILDER_BUN" "$S22_BUILDER/scripts/s22-clean-destination-transition.ts" \
      reconcile --launch-start "$LAUNCH_START" \
      --root-evidence "$ROOT_RECONCILIATION_EVIDENCE" >"$RECONCILIATION_RESPONSE"
  )
  RECONCILIATION_STATUS=$?
  set -e
fi

if [[ $ROOT_RECONCILIATION_EVIDENCE_VALID == true \
  && $RECONCILIATION_STATUS == 0 ]] && /usr/bin/jq -e '
  .schema_version == "chorus.s22-clean-destination-reconciliation-report/1"
  and .state == "finish-existing-success"
  and .read_only == true
  and .root_operations_performed == false
  and .repeat_privileged_launch == false
  and .production_deploy == false
  and .evidence_authority == "root-export"
  and .authoritative == true
  and .candidate_siblings_absent == true
  and .installed_files_verified == true
  and .complete_receipt_semantics_verified == true
  and (.signing_public_key_ed25519_hex | test("^[0-9a-f]{64}$"))
' "$RECONCILIATION_RESPONSE" >/dev/null
then
  TRANSITION_OUTCOME=succeeded
  TRANSITION_EXPECTED_STATE=succeeded
  TRANSITION_ERROR=
  TRANSITION_ERROR_ARGS=()
else
  TRANSITION_OUTCOME=terminal_failure
  TRANSITION_EXPECTED_STATE=failed
  TRANSITION_ERROR=clean_destination_not_verified
  TRANSITION_ERROR_ARGS=(--error "$TRANSITION_ERROR")
fi

# Finish cannot authorize another launch. It records the reconciliation result only.
( set -o noclobber
  "$S22_BUILDER_BUN" "$S22_BUILDER/packages/cli/src/index.ts" \
    approvals execution finish --profile inu \
    --attempt-id "$APPROVAL_ATTEMPT_ID" \
    --approval-response "$APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$EXPECTED_ACTION_FINGERPRINT" \
    --revision "$APPROVAL_REVISION" --outcome "$TRANSITION_OUTCOME" \
    "${TRANSITION_ERROR_ARGS[@]}" --json >"$FINISH_RESPONSE"
)
/usr/bin/jq -e \
  --arg gate "$APPROVAL_GATE_ID" \
  --arg attempt "$APPROVAL_ATTEMPT_ID" \
  --arg fingerprint "$EXPECTED_ACTION_FINGERPRINT" \
  --arg state "$TRANSITION_EXPECTED_STATE" \
  --arg error "$TRANSITION_ERROR" \
  --argjson revision "$APPROVAL_REVISION" '
    (.status == "finished" or .status == "idempotent")
    and .execution_authorized == false
    and .attempt.gate_id == $gate
    and .attempt.attempt_id == $attempt
    and .attempt.request_fingerprint == $fingerprint
    and .attempt.state == $state
    and .attempt.revision == ($revision + 1)
    and (.attempt.completed_at | type == "string")
    and (if $state == "succeeded" then .attempt.last_error == null
         else .attempt.last_error == $error end)
  ' "$FINISH_RESPONSE" >/dev/null
test "$TRANSITION_EXPECTED_STATE" = succeeded

The fixed launcher uses /proc/$$/fd only after it has verified procfs filesystem magic, both initial user-namespace UID and GID maps, the gate-bound destination boot ID, and the exact destination mount, network, and PID namespace names plus device/inode identities. It also requires /proc/1/ns/pid to equal the fenced PID namespace and cross-binds those identities to the pinned plan before any root mutation. An alternate user or mount namespace, substituted procfs, or stale boot therefore fails closed before the descriptor links are used. After active native signature and lease verification, it copies the exact plan/executor into root custody and publishes approval-begin-verification.json there with no-replace semantics before any foundation mutation. Later read-only observations require that immutable verification fence; they do not reopen the owner attestation or reapply its expired lease.

Success publishes /var/lib/chorus/s22/m001/clean-destination-foundation-receipt.json only after postflight verification; transition-package.json remains the inert package descriptor. The root journal is written before any root mutation of a foundation path, account, seed, policy, or anchor and binds the gate, fingerprint, stable attempt ID, and revision. The final receipt cross-binds that journal and the same tuple.

If launch-start exists, interruption is always reconcile-only. Never repeat the mutating fixed-launcher vector or generated executor. After every possibly live process is known stopped, use only the launch fence’s exact observation vector. Each call adds the next numbered root-owned snapshot under the approval-bound prefix (up to 64); no snapshot is overwritten. Then use the bounded non-root reconciliation command to parse and cross-bind the exact path returned by that observation. A complete matching receipt finishes the existing attempt as succeeded. A missing journal is dispatch-ambiguous; a journal without a receipt is root-incomplete; a changed tuple, source package, destination boot ID, file fact, or receipt binding is conflicting. Wait for any known live process to terminate, retain every path, finish with the truthful bounded failure outcome when determinable, and require a fresh package path, attempt ID, and gate for any later launch. There is no exact-transaction privileged reopen.

Every item below is non-authorizing and must not reach sudo:

[
  "approved-status-only",
  "pending",
  "denied",
  "cancelled",
  "accepted-without-execution_authorized",
  "resumed-after-launch-start",
  "observed_in_flight",
  "observed_completed",
  "expired",
  "conflict",
  "malformed-begin-response",
  "finish-response"
]

This approval does not authorize any production deployment. It also does not authorize broker invocation, service start, or customer traffic.

Root-custody the broker seed before signing

The clean-destination transition has already created exactly one 32-byte Ed25519 seed at /etc/chorus/s22/m001/broker-signing-seed.bin, root-owned, single-linked, and mode 0400; it also committed that fact in the authoritative transition receipt. Do not create, replace, regenerate, or rotate it here. The measured renderer never opens the seed, copies it, hashes it, or includes it in output. It accepts only the corresponding raw 32-byte public key as 64 lowercase hex characters. The native broker later derives the public key from the fixed seed again and fails closed if it differs.

The approved transition already derived the public key through its retained seed descriptor, cleared the seed buffer, and committed the public hex in the root receipt. The separate root observation rederived it through the same measured Bun authority and the non-root reconciler accepted it only after complete receipt reconstruction. Never open the root seed again here. Consume only that already verified public field:

: "${RECONCILIATION_RESPONSE:?authoritative transition reconciliation report}"
SIGNING_PUBLIC_KEY=$(
  /usr/bin/jq -er '
    select(.schema_version == "chorus.s22-clean-destination-reconciliation-report/1")
    | select(.authoritative == true and .complete_receipt_semantics_verified == true)
    | .signing_public_key_ed25519_hex
    | select(test("^[0-9a-f]{64}$"))
  ' "$RECONCILIATION_RESPONSE"
)
export SIGNING_PUBLIC_KEY
test "${#SIGNING_PUBLIC_KEY}" -eq 64

Export the public foundation to operator custody

Phase one must not run against the private root candidate directories: their 0700 parents and 0400 receipts are intentionally unreadable to the non-root operator. The first foundation gate includes this export. It must bind the exact export directory, operator UID/GID, source paths, and byte commitments; otherwise stop and obtain a new gate.

Under that gate, publish one new root-owned, non-writable export directory beneath /var/lib/chorus/s22-public/m001. Every ancestor must be root-owned, non-writable, and searchable by the operator. Copy only these public build products from the freshly verified root candidates:

Export name	Operator-copy mode
launcher	0755
preload.so	0555
broker-build-host-trust-anchor.json	0400
broker-build-receipt.json	0400
aot-build-receipt.json	0400
foundation-attestor-policy.json	0400
measured-aot-policy.json	0444
source-manifest.txt	0400
runtime-objects-manifest.txt	0400
arguments-manifest.txt	0400
environment-manifest.txt	0400
bunfig.toml	0444
tsconfig.json	0444

The root export uses 0444 for every non-executable file and 0555 for the two executables so the operator can read it without being able to mutate it. Every source is reopened without following symlinks, must have link count one, and must match its reviewed SHA-256, size, owner, and fixed source mode. The exporter also remeasures the exact source manifest: every directory must be root:root 0555, the fixed emitted bundle must be root:root 0555, and every other source file must be root:root 0444.

Prepare one canonical chorus.s22-foundation-export-request/1 JSON line. It contains authority: "root-frozen-production", the new absolute export_directory, exact source_root, non-root operator_uid/operator_gid, both operation flags set to false, and a files object with exactly the thirteen table names. Each file entry has only path, sha256, and size_bytes; the command hard-codes every source, export, and operator-copy mode. Every source path must use its fixed basename. The request has no field for a seed, private key, signed campaign authority, terminal request, consumption record, config, or publication state.

The production action wrapper is scripts/s22-foundation-export-execution.ts. It measures the complete root authority closure, embeds the canonical request bytes, derives the independent Chorus action fingerprint, validates the signed approval-begin artifact, publishes the exclusive launch fence, and emits the only permitted privileged argv. Do not reconstruct the exporter command, copy the request into root custody by hand, or invoke the inner render/verify commands directly.

The order is fail closed:

owner request → approval payload → independent fingerprint → high-risk gate → human approval → signed execution begin → exclusive launch-start → verified emitted argv once → public-custody reconciliation → execution finish.

On first execution, use a not-yet-existing owner-only state directory and one stable attempt ID. To recover after an interruption or a lost accepted response, rerun this same block with the exact same directory, flow ID, attempt ID, and inputs. Recovery reuses append-only observations, retries only the same idempotent begin or finish, and never creates or approves a replacement gate. The approval response may contain a one-time capability; capture it only in the mode-0600 file below and never print or paste it. The helpers retry the same stable attempt ID and recover its exact accepted revision. Once launch-start exists, the helper never repeats the privileged argv, even if output was lost. After any accepted begin, every executable path drives the same attempt to a validated terminal finish. The helpers finalize a failed or incomplete reconciliation as terminal failure, and the shell returns nonzero.

An observed_in_flight response recovers the accepted revision but does not authorize launch; only the matching signed begin attestation does. An observed_completed response permanently suppresses launch, recovers the preceding accepted revision, and is confirmed through the same idempotent finish call.

: "${S22_ROOT_BUN:?root-owned reviewed Bun}"
: "${S22_ROOT_BUILDER:?root-owned reviewed builder tree}"
: "${S22_FOUNDATION_REQUEST_BASE64:?reviewed canonical request bytes}"
: "${S22_FOUNDATION_REQUEST_SHA256:?reviewed 64-character lowercase digest}"
: "${FOUNDATION_EXPORT_STATE:?canonical owner-only state directory; reuse for recovery}"
: "${FOUNDATION_EXPORT_FLOW_ID:?fresh lowercase evidence identifier}"
: "${FOUNDATION_EXPORT_ATTEMPT_ID:?stable attempt ID for this exact action}"
: "${APPROVER_IDENTITY:?explicit human approver identity}"

set -euo pipefail
umask 077
[[ $FOUNDATION_EXPORT_FLOW_ID =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]]
[[ $S22_FOUNDATION_REQUEST_SHA256 =~ ^[0-9a-f]{64}$ ]]
FOUNDATION_RECOVERY_MODE=false
if [[ -e $FOUNDATION_EXPORT_STATE && ! -L $FOUNDATION_EXPORT_STATE ]]; then
  FOUNDATION_RECOVERY_MODE=true
else
  test ! -e "$FOUNDATION_EXPORT_STATE" -a ! -L "$FOUNDATION_EXPORT_STATE"
  /usr/bin/mkdir -m 0700 -- "$FOUNDATION_EXPORT_STATE"
fi
test "$(/usr/bin/realpath -e -- "$FOUNDATION_EXPORT_STATE")" = \
  "$FOUNDATION_EXPORT_STATE"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$FOUNDATION_EXPORT_STATE")" = \
  "700 $(/usr/bin/id -u) $(/usr/bin/id -g)"

FOUNDATION_REQUEST=$FOUNDATION_EXPORT_STATE/foundation-export-request.json
FOUNDATION_ACTION=\
$FOUNDATION_EXPORT_STATE/s22-foundation-export-execution-approval.json
FOUNDATION_APPROVAL_ATTESTATION=\
$FOUNDATION_EXPORT_STATE/s22-foundation-export-execution-approval-begin-attestation.json
FOUNDATION_LAUNCH_START=\
$FOUNDATION_EXPORT_STATE/s22-foundation-export-execution-launch-start.json
FOUNDATION_GATE_REQUEST=$FOUNDATION_EXPORT_STATE/gate-request.json
FOUNDATION_GATE_CREATE=$FOUNDATION_EXPORT_STATE/gate-create.json
FOUNDATION_APPROVAL_RESPONSE=$FOUNDATION_EXPORT_STATE/approval-response.json
FOUNDATION_BEGIN_RESPONSE_PREFIX=\
$FOUNDATION_EXPORT_STATE/begin-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_BEGIN_RESPONSE=
FOUNDATION_LAUNCH_PUBLICATION=\
$FOUNDATION_EXPORT_STATE/launch-publication-$FOUNDATION_EXPORT_FLOW_ID.json
FOUNDATION_VERIFIED_LAUNCH_PREFIX=\
$FOUNDATION_EXPORT_STATE/verified-launch-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_VERIFIED_LAUNCH=
FOUNDATION_PRIVILEGED_ARGV_NUL_PREFIX=\
$FOUNDATION_EXPORT_STATE/privileged-argv-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_PRIVILEGED_ARGV_NUL=
FOUNDATION_RECONCILIATION_ARGV_NUL_PREFIX=\
$FOUNDATION_EXPORT_STATE/reconciliation-argv-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_RECONCILIATION_ARGV_NUL=
FOUNDATION_ROOT_RESULT=\
$FOUNDATION_EXPORT_STATE/root-result-$FOUNDATION_EXPORT_FLOW_ID.txt
FOUNDATION_RECONCILIATION_RESPONSE_PREFIX=\
$FOUNDATION_EXPORT_STATE/reconciliation-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_RECONCILIATION_RESPONSE=
FOUNDATION_FINISH_RESPONSE_PREFIX=\
$FOUNDATION_EXPORT_STATE/finish-$FOUNDATION_EXPORT_FLOW_ID-
FOUNDATION_FINISH_RESPONSE=
FOUNDATION_BEGIN_RETRY_LIMIT=8
FOUNDATION_FINISH_RETRY_LIMIT=8
FOUNDATION_EXECUTION_TOOL=\
$S22_ROOT_BUILDER/scripts/s22-foundation-export-execution.ts
FOUNDATION_EXECUTOR=$S22_ROOT_BUILDER/scripts/s22-foundation-export-executor.sh
FOUNDATION_INNER_EXPORTER=\
$S22_ROOT_BUILDER/scripts/export-s22-measured-foundation.ts
APPROVAL_ATTESTATION_VERIFIER=\
/usr/local/libexec/chorus/s22/approval-begin-v1/verifier
APPROVAL_ATTESTATION_KEY_DIRECTORY=\
/etc/chorus/approval-execution-attestation/v1/keys
mapfile -t FOUNDATION_APPROVAL_ATTESTATION_KEYS < <(
  /usr/bin/find "$APPROVAL_ATTESTATION_KEY_DIRECTORY" -maxdepth 1 -type f \
    -name 'ed25519-sha256-*.spki' -printf '%p\n' | LC_ALL=C /usr/bin/sort
)
[[ ${#FOUNDATION_APPROVAL_ATTESTATION_KEYS[@]} -ge 1 \
  && ${#FOUNDATION_APPROVAL_ATTESTATION_KEYS[@]} -le 2 ]]
FOUNDATION_APPROVAL_ATTESTATION_KEYS_CSV=$(
  IFS=,
  /usr/bin/printf '%s' "${FOUNDATION_APPROVAL_ATTESTATION_KEYS[*]}"
)

run_foundation_execution_tool() {
  /usr/bin/env -i \
    PATH=/usr/bin:/bin:/usr/sbin:/sbin LANG=C LC_ALL=C TZ=UTC \
    HOME=/nonexistent XDG_CONFIG_HOME=/nonexistent \
    "$S22_ROOT_BUN" --no-install --no-env-file --config=/dev/null --cwd=/ \
    "$FOUNDATION_EXECUTION_TOOL" "$@"
}

# BEGIN FOUNDATION_DURABLE_ATTEMPT_HELPERS
foundation_next_observation_path() {
  local prefix=$1
  local limit=$2
  local index sequence candidate
  for ((index = 1; index <= limit; index++)); do
    printf -v sequence '%06d' "$index"
    candidate=${prefix}${sequence}.json
    if [[ ! -e $candidate && ! -L $candidate ]]; then
      FOUNDATION_NEXT_OBSERVATION=$candidate
      return 0
    fi
  done
  return 1
}

foundation_execution_begin_cli() {
  local attestation_output=$1
  local attestation_args=()
  if [[ -n $attestation_output ]]; then
    attestation_args=(--attestation-output "$attestation_output")
  fi
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals execution begin --profile inu \
    --attempt-id "$FOUNDATION_EXPORT_ATTEMPT_ID" \
    --approval-response "$FOUNDATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
    "${attestation_args[@]}" --json
}

foundation_validate_begin_response() {
  local response=$1
  local revision response_revision status
  /usr/bin/jq -e \
    --arg gate "$FOUNDATION_GATE_ID" \
    --arg attempt "$FOUNDATION_EXPORT_ATTEMPT_ID" \
    --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" '
      .attempt.gate_id == $gate
      and .attempt.attempt_id == $attempt
      and .attempt.request_fingerprint == $fingerprint
      and (.attempt.revision | type == "number" and floor == .
        and . >= 1 and . <= 2147483647)
      and (
        (
          (
            (.status == "accepted" and .attempt.revision == 1)
            or (.status == "resumed" and .attempt.revision >= 2)
          )
          and .execution_authorized == true
          and .attempt.state == "accepted"
          and .attempt.completed_at == null
          and .attempt.last_error == null
        )
        or (
          .status == "observed_in_flight"
          and .execution_authorized == false
          and .attempt.state == "accepted"
          and .attempt.completed_at == null
          and .attempt.last_error == null
        )
        or (
          .status == "observed_completed"
          and .execution_authorized == false
          and .attempt.revision >= 2
          and (.attempt.completed_at | type == "string" and length > 0)
          and (
            (.attempt.state == "succeeded" and .attempt.last_error == null)
            or (
              .attempt.state == "abandoned"
              and (.attempt.last_error | type == "string"
                and length > 0 and length <= 128)
            )
          )
        )
      )
    ' "$response" >/dev/null || return 1
  status=$(/usr/bin/jq -er '.status' "$response") || return 1
  response_revision=$(
    /usr/bin/jq -er '.attempt.revision' "$response"
  ) || return 1
  if [[ $status == observed_completed ]]; then
    revision=$((response_revision - 1))
  else
    revision=$response_revision
  fi
  [[ $revision =~ ^[1-9][0-9]*$ ]] || return 1
  if [[ $FOUNDATION_REVISION_SAFE != true \
    || $revision -gt $FOUNDATION_APPROVAL_REVISION \
    || ( $revision -eq $FOUNDATION_APPROVAL_REVISION \
      && $status == observed_completed ) ]]
  then
    FOUNDATION_BEGIN_RESPONSE=$response
    FOUNDATION_APPROVAL_REVISION=$revision
    FOUNDATION_BEGIN_OBSERVED_TERMINAL=false
    FOUNDATION_BEGIN_TERMINAL_STATE=
    FOUNDATION_BEGIN_TERMINAL_ERROR=
    if [[ $status == observed_completed ]]; then
      FOUNDATION_BEGIN_OBSERVED_TERMINAL=true
      FOUNDATION_BEGIN_TERMINAL_STATE=$(
        /usr/bin/jq -er '.attempt.state' "$response"
      ) || return 1
      FOUNDATION_BEGIN_TERMINAL_ERROR=$(
        /usr/bin/jq -er '.attempt.last_error // ""' "$response"
      ) || return 1
    fi
    FOUNDATION_REVISION_SAFE=true
  fi
}

foundation_recover_begin_revision() {
  local response attestation_output retry
  FOUNDATION_REVISION_SAFE=false
  FOUNDATION_BEGIN_READY=false
  FOUNDATION_BEGIN_OBSERVED_TERMINAL=false
  FOUNDATION_BEGIN_TERMINAL_STATE=
  FOUNDATION_BEGIN_TERMINAL_ERROR=
  FOUNDATION_APPROVAL_REVISION=
  FOUNDATION_BEGIN_RESPONSE=

  for response in "${FOUNDATION_BEGIN_RESPONSE_PREFIX}"*.json; do
    [[ -f $response && ! -L $response ]] || continue
    foundation_validate_begin_response "$response" || true
  done

  for ((retry = 1; retry <= FOUNDATION_BEGIN_RETRY_LIMIT; retry++)); do
    [[ $FOUNDATION_REVISION_SAFE != true ]] || break
    foundation_next_observation_path \
      "$FOUNDATION_BEGIN_RESPONSE_PREFIX" 1024 || return 1
    response=$FOUNDATION_NEXT_OBSERVATION
    if [[ ! -e $FOUNDATION_APPROVAL_ATTESTATION \
      && ! -L $FOUNDATION_APPROVAL_ATTESTATION ]]
    then
      attestation_output=$FOUNDATION_APPROVAL_ATTESTATION
    elif [[ -f $FOUNDATION_APPROVAL_ATTESTATION \
      && ! -L $FOUNDATION_APPROVAL_ATTESTATION ]]
    then
      attestation_output=
    else
      return 1
    fi
    if ( set -o noclobber
      foundation_execution_begin_cli "$attestation_output" >"$response"
    ); then
      FOUNDATION_BEGIN_COMMAND_STATUS=0
    else
      FOUNDATION_BEGIN_COMMAND_STATUS=$?
    fi
    foundation_validate_begin_response "$response" || true
  done
  [[ $FOUNDATION_REVISION_SAFE == true ]] || return 1

  if test "$(/usr/bin/stat -Lc '%a %u %g %h' -- \
    "$FOUNDATION_APPROVAL_ATTESTATION" 2>/dev/null)" = \
    "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1" \
    && /usr/bin/jq -e \
      --arg type host.s22_public_foundation_export \
      --arg gate "$FOUNDATION_GATE_ID" \
      --arg attempt "$FOUNDATION_EXPORT_ATTEMPT_ID" \
      --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
      --argjson revision "$FOUNDATION_APPROVAL_REVISION" '
        .attestation.payload.gate_action_type == $type
        and .attestation.payload.gate_id == $gate
        and .attestation.payload.execution_authorized == true
        and .attestation.payload.attempt.attempt_id == $attempt
        and .attestation.payload.attempt.request_fingerprint == $fingerprint
        and .attestation.payload.attempt.revision == $revision
        and (.attestation.signature_base64url | type == "string" and length > 0)
      ' "$FOUNDATION_APPROVAL_ATTESTATION" >/dev/null
  then
    FOUNDATION_BEGIN_READY=true
  fi
}

foundation_dispatch_new_launch_once() {
  FOUNDATION_ROOT_STATUS=125
  if [[ $FOUNDATION_NEW_LAUNCH == true \
    && $FOUNDATION_VECTOR_STATUS == 0 ]]
  then
    ( set -o noclobber
      "${FOUNDATION_PRIVILEGED_ARGV[@]}" >"$FOUNDATION_ROOT_RESULT"
    )
    FOUNDATION_ROOT_STATUS=$?
  fi
}

foundation_execution_finish_cli() {
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals execution finish --profile inu \
    --attempt-id "$FOUNDATION_EXPORT_ATTEMPT_ID" \
    --approval-response "$FOUNDATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
    --revision "$FOUNDATION_APPROVAL_REVISION" \
    --outcome "$FOUNDATION_OUTCOME" "${FOUNDATION_ERROR_ARGS[@]}" \
    --json
}

foundation_validate_finish_response() {
  local response=$1
  /usr/bin/jq -e \
    --arg gate "$FOUNDATION_GATE_ID" \
    --arg attempt "$FOUNDATION_EXPORT_ATTEMPT_ID" \
    --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
    --arg state "$FOUNDATION_EXPECTED_STATE" \
    --arg error "$FOUNDATION_ERROR" \
    --argjson revision "$FOUNDATION_APPROVAL_REVISION" '
      (.status == "finished" or .status == "idempotent")
      and .execution_authorized == false
      and .attempt.gate_id == $gate
      and .attempt.attempt_id == $attempt
      and .attempt.request_fingerprint == $fingerprint
      and .attempt.state == $state
      and .attempt.revision == ($revision + 1)
      and (.attempt.completed_at | type == "string")
      and (if $state == "succeeded" then .attempt.last_error == null
           else .attempt.last_error == $error end)
    ' "$response" >/dev/null
}

foundation_finish_until_validated() {
  local response retry
  FOUNDATION_FINISH_RESPONSE=
  for response in "${FOUNDATION_FINISH_RESPONSE_PREFIX}"*.json; do
    [[ -f $response && ! -L $response ]] || continue
    if foundation_validate_finish_response "$response"; then
      FOUNDATION_FINISH_RESPONSE=$response
      return 0
    fi
  done
  for ((retry = 1; retry <= FOUNDATION_FINISH_RETRY_LIMIT; retry++)); do
    foundation_next_observation_path \
      "$FOUNDATION_FINISH_RESPONSE_PREFIX" 1024 || return 1
    response=$FOUNDATION_NEXT_OBSERVATION
    if ( set -o noclobber
      foundation_execution_finish_cli >"$response"
    ); then
      FOUNDATION_FINISH_STATUS=0
    else
      FOUNDATION_FINISH_STATUS=$?
    fi
    if foundation_validate_finish_response "$response"; then
      FOUNDATION_FINISH_RESPONSE=$response
      return 0
    fi
  done
  return 1
}

foundation_select_finish_contract() {
  if [[ $FOUNDATION_BEGIN_OBSERVED_TERMINAL == true ]]; then
    if [[ $FOUNDATION_BEGIN_TERMINAL_STATE == succeeded \
      && -z $FOUNDATION_BEGIN_TERMINAL_ERROR ]]
    then
      FOUNDATION_OUTCOME=succeeded
      FOUNDATION_EXPECTED_STATE=succeeded
      FOUNDATION_ERROR=
      FOUNDATION_ERROR_ARGS=()
      return 0
    fi
    if [[ $FOUNDATION_BEGIN_TERMINAL_STATE == abandoned \
      && -n $FOUNDATION_BEGIN_TERMINAL_ERROR ]]
    then
      FOUNDATION_OUTCOME=terminal_failure
      FOUNDATION_EXPECTED_STATE=abandoned
      FOUNDATION_ERROR=$FOUNDATION_BEGIN_TERMINAL_ERROR
      FOUNDATION_ERROR_ARGS=(--error "$FOUNDATION_ERROR")
      return 0
    fi
    return 1
  fi

  if [[ $FOUNDATION_RECONCILIATION_VERIFIED == true ]]; then
    FOUNDATION_OUTCOME=succeeded
    FOUNDATION_EXPECTED_STATE=succeeded
    FOUNDATION_ERROR=
    FOUNDATION_ERROR_ARGS=()
  else
    FOUNDATION_OUTCOME=terminal_failure
    FOUNDATION_EXPECTED_STATE=abandoned
    FOUNDATION_ERROR=foundation_export_not_verified
    FOUNDATION_ERROR_ARGS=(--error "$FOUNDATION_ERROR")
  fi
}

foundation_require_verified_success() {
  test "$FOUNDATION_EXPECTED_STATE" = succeeded \
    && test "$FOUNDATION_RECONCILIATION_VERIFIED" = true
}
# END FOUNDATION_DURABLE_ATTEMPT_HELPERS

if [[ $FOUNDATION_RECOVERY_MODE == false ]]; then
  ( set -o noclobber
    /usr/bin/printf '%s' "$S22_FOUNDATION_REQUEST_BASE64" \
      | /usr/bin/base64 --decode >"$FOUNDATION_REQUEST"
  )
/usr/bin/chmod 0600 -- "$FOUNDATION_REQUEST"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$FOUNDATION_REQUEST")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
FOUNDATION_REQUEST_SHA=$(/usr/bin/sha256sum -- "$FOUNDATION_REQUEST")
test "${FOUNDATION_REQUEST_SHA%% *}" = "$S22_FOUNDATION_REQUEST_SHA256"
run_foundation_execution_tool approval-payload \
  --request "$FOUNDATION_REQUEST" \
  --bun "$S22_ROOT_BUN" \
  --action-tool "$FOUNDATION_EXECUTION_TOOL" \
  --executor "$FOUNDATION_EXECUTOR" \
  --exporter "$FOUNDATION_INNER_EXPORTER" \
  --approval-attestation-verifier "$APPROVAL_ATTESTATION_VERIFIER" \
  --approval-attestation-keys "$FOUNDATION_APPROVAL_ATTESTATION_KEYS_CSV" \
  --output "$FOUNDATION_ACTION" >/dev/null
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$FOUNDATION_ACTION")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
FOUNDATION_EXPECTED_FINGERPRINT=$(
  run_foundation_execution_tool approval-fingerprint \
    --approval "$FOUNDATION_ACTION"
)
[[ $FOUNDATION_EXPECTED_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
S22_FOUNDATION_EXPORT=$(
  /usr/bin/jq -er '
    select(.schema_version ==
      "chorus.s22-foundation-export-execution-approval/1")
    | select(.action_type == "host.s22_public_foundation_export")
    | select(.allowed_result.production_deploy == false)
    | select(.allowed_result.service_start == false)
    | select(.allowed_result.broker_invocation == false)
    | .request.export_directory
  ' "$FOUNDATION_ACTION"
)
export S22_FOUNDATION_EXPORT

( set -o noclobber
  /usr/bin/jq -nS \
    --arg type host.s22_public_foundation_export \
    --arg summary \
      "Publish exactly one public S22 foundation export; no install, service, broker, or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$FOUNDATION_ACTION" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "high",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    ' >"$FOUNDATION_GATE_REQUEST"
)
( set -o noclobber
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals create --profile inu --from-file "$FOUNDATION_GATE_REQUEST" \
    --json >"$FOUNDATION_GATE_CREATE"
)
/usr/bin/jq -e \
  --arg type host.s22_public_foundation_export \
  --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
  --slurpfile action "$FOUNDATION_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and .status == "pending"
  ' "$FOUNDATION_GATE_CREATE" >/dev/null
FOUNDATION_GATE_ID=$(/usr/bin/jq -er '.id' "$FOUNDATION_GATE_CREATE")

# HUMAN CHECKPOINT: inspect FOUNDATION_ACTION, then Inu runs this exact command once.
# The response stays in its owner-only file; never print its capability.
( set -o noclobber
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals approve "$FOUNDATION_GATE_ID" --profile inu \
    --note "I authorize exactly this public foundation export, with no install, service start, broker invocation, or deployment." \
    --json >"$FOUNDATION_APPROVAL_RESPONSE"
)
else
  for FOUNDATION_REQUIRED_STATE in \
    "$FOUNDATION_REQUEST" "$FOUNDATION_ACTION" "$FOUNDATION_GATE_REQUEST" \
    "$FOUNDATION_GATE_CREATE" "$FOUNDATION_APPROVAL_RESPONSE"
  do
    test -f "$FOUNDATION_REQUIRED_STATE" -a ! -L "$FOUNDATION_REQUIRED_STATE"
  done
fi

FOUNDATION_REQUEST_SHA=$(/usr/bin/sha256sum -- "$FOUNDATION_REQUEST")
test "${FOUNDATION_REQUEST_SHA%% *}" = "$S22_FOUNDATION_REQUEST_SHA256"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$FOUNDATION_ACTION")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"
FOUNDATION_EXPECTED_FINGERPRINT=$(
  run_foundation_execution_tool approval-fingerprint \
    --approval "$FOUNDATION_ACTION"
)
[[ $FOUNDATION_EXPECTED_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
S22_FOUNDATION_EXPORT=$(
  /usr/bin/jq -er '
    select(.schema_version ==
      "chorus.s22-foundation-export-execution-approval/1")
    | select(.action_type == "host.s22_public_foundation_export")
    | select(.allowed_result.production_deploy == false)
    | select(.allowed_result.service_start == false)
    | select(.allowed_result.broker_invocation == false)
    | .request.export_directory
  ' "$FOUNDATION_ACTION"
)
export S22_FOUNDATION_EXPORT
/usr/bin/jq -e \
  --arg type host.s22_public_foundation_export \
  --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
  --slurpfile action "$FOUNDATION_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and (.status == "pending" or .status == "approved")
  ' "$FOUNDATION_GATE_CREATE" >/dev/null
FOUNDATION_GATE_ID=$(/usr/bin/jq -er '.id' "$FOUNDATION_GATE_CREATE")
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$FOUNDATION_APPROVAL_RESPONSE")" = \
  "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1"

# From the begin request onward, `set -e` must not strand an accepted
# attempt. Capture every status and finish any revision that can be bound safely.
set +e
if ! foundation_recover_begin_revision; then
  /usr/bin/printf '%s\n' \
    'same-attempt foundation begin recovery is not yet observable; rerun this exact state directory and attempt while the approved capability remains valid' \
    >&2
  exit 75
fi

# From here every branch finishes the accepted attempt. A launch fence is permanent:
# an existing fence is reconciliation-only and never permits another root launch.
FOUNDATION_NEW_LAUNCH=false
FOUNDATION_LAUNCH_STATUS=125
if [[ $FOUNDATION_BEGIN_READY == true \
  && $FOUNDATION_BEGIN_OBSERVED_TERMINAL != true \
  && ! -e $FOUNDATION_LAUNCH_START && ! -L $FOUNDATION_LAUNCH_START ]]
then
  ( set -o noclobber
    run_foundation_execution_tool launch-start \
      --approval "$FOUNDATION_ACTION" \
      --path "$FOUNDATION_LAUNCH_START" \
      --approval-attestation "$FOUNDATION_APPROVAL_ATTESTATION" \
      >"$FOUNDATION_LAUNCH_PUBLICATION"
  )
  FOUNDATION_LAUNCH_STATUS=$?
  if [[ $FOUNDATION_LAUNCH_STATUS == 0 ]]; then
    FOUNDATION_NEW_LAUNCH=true
  fi
fi

FOUNDATION_VERIFY_STATUS=1
if [[ $FOUNDATION_BEGIN_READY == true \
  && -f $FOUNDATION_LAUNCH_START && ! -L $FOUNDATION_LAUNCH_START ]]
then
  if foundation_next_observation_path \
    "$FOUNDATION_VERIFIED_LAUNCH_PREFIX" 1024
  then
    FOUNDATION_VERIFIED_LAUNCH=$FOUNDATION_NEXT_OBSERVATION
    ( set -o noclobber
      run_foundation_execution_tool verify-launch-start \
        --approval "$FOUNDATION_ACTION" \
        --path "$FOUNDATION_LAUNCH_START" \
        >"$FOUNDATION_VERIFIED_LAUNCH"
    )
    FOUNDATION_VERIFY_STATUS=$?
  fi
fi

FOUNDATION_PRIVILEGED_ARGV=()
FOUNDATION_RECONCILIATION_ARGV=()
FOUNDATION_VECTOR_STATUS=1
if [[ $FOUNDATION_VERIFY_STATUS == 0 ]] \
  && /usr/bin/jq -e \
    --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
    --arg launch "$FOUNDATION_LAUNCH_START" '
      .schema_version ==
        "chorus.s22-foundation-export-execution-launch-publication/1"
      and .file.path == $launch
      and .launch_start.approval_fingerprint == $fingerprint
      and .launch_start.authorization.execution_authorized == true
      and .launch_start.root_launch_may_have_begun == true
      and .launch_start.repeat_privileged_launch == false
      and .launch_start.production_deploy == false
      and .launch_start.service_start == false
      and .launch_start.broker_invocation == false
      and (.privileged_argv | type == "array" and length > 0
        and all(.[]; type == "string" and length > 0))
      and (.reconciliation_argv | type == "array" and length == 3
        and all(.[]; type == "string" and length > 0))
    ' "$FOUNDATION_VERIFIED_LAUNCH" >/dev/null
then
  FOUNDATION_PRIVILEGED_VECTOR_STATUS=1
  FOUNDATION_RECONCILIATION_VECTOR_STATUS=1
  if foundation_next_observation_path \
    "$FOUNDATION_PRIVILEGED_ARGV_NUL_PREFIX" 1024
  then
    FOUNDATION_PRIVILEGED_ARGV_NUL=$FOUNDATION_NEXT_OBSERVATION
    ( set -o noclobber
      /usr/bin/jq -j '.privileged_argv[] | ., "\u0000"' \
        "$FOUNDATION_VERIFIED_LAUNCH" >"$FOUNDATION_PRIVILEGED_ARGV_NUL"
    )
    FOUNDATION_PRIVILEGED_VECTOR_STATUS=$?
  fi
  if foundation_next_observation_path \
    "$FOUNDATION_RECONCILIATION_ARGV_NUL_PREFIX" 1024
  then
    FOUNDATION_RECONCILIATION_ARGV_NUL=$FOUNDATION_NEXT_OBSERVATION
    ( set -o noclobber
      /usr/bin/jq -j '.reconciliation_argv[] | ., "\u0000"' \
        "$FOUNDATION_VERIFIED_LAUNCH" >"$FOUNDATION_RECONCILIATION_ARGV_NUL"
    )
    FOUNDATION_RECONCILIATION_VECTOR_STATUS=$?
  fi
  if [[ $FOUNDATION_PRIVILEGED_VECTOR_STATUS == 0 \
    && $FOUNDATION_RECONCILIATION_VECTOR_STATUS == 0 ]]
  then
    mapfile -d '' -t FOUNDATION_PRIVILEGED_ARGV \
      <"$FOUNDATION_PRIVILEGED_ARGV_NUL"
    FOUNDATION_PRIVILEGED_MAP_STATUS=$?
    mapfile -d '' -t FOUNDATION_RECONCILIATION_ARGV \
      <"$FOUNDATION_RECONCILIATION_ARGV_NUL"
    FOUNDATION_RECONCILIATION_MAP_STATUS=$?
    if [[ $FOUNDATION_PRIVILEGED_MAP_STATUS == 0 \
      && $FOUNDATION_RECONCILIATION_MAP_STATUS == 0 \
      && ${#FOUNDATION_PRIVILEGED_ARGV[@]} -gt 0 \
      && ${#FOUNDATION_RECONCILIATION_ARGV[@]} -eq 3 ]]
    then
      FOUNDATION_VECTOR_STATUS=0
    fi
  fi
fi

# This is the sole mutating dispatch. The helper executes it only for a launch
# fence created by this invocation; any pre-existing fence is reconciliation-only.
foundation_dispatch_new_launch_once

FOUNDATION_RECONCILIATION_STATUS=1
if [[ $FOUNDATION_VECTOR_STATUS == 0 ]]; then
  # The emitted reconciliation vector reads only immutable public root custody.
  if foundation_next_observation_path \
    "$FOUNDATION_RECONCILIATION_RESPONSE_PREFIX" 1024
  then
    FOUNDATION_RECONCILIATION_RESPONSE=$FOUNDATION_NEXT_OBSERVATION
    ( set -o noclobber
      "${FOUNDATION_RECONCILIATION_ARGV[@]}" \
        >"$FOUNDATION_RECONCILIATION_RESPONSE"
    )
    FOUNDATION_RECONCILIATION_STATUS=$?
  fi
fi

FOUNDATION_RECONCILIATION_VERIFIED=false
if [[ $FOUNDATION_BEGIN_READY == true \
  && $FOUNDATION_RECONCILIATION_STATUS == 0 ]] \
  && /usr/bin/jq -e \
    --arg fingerprint "$FOUNDATION_EXPECTED_FINGERPRINT" \
    --arg export "$S22_FOUNDATION_EXPORT" '
      .schema_version ==
        "chorus.s22-foundation-export-execution-reconciliation/1"
      and .action_type == "host.s22_public_foundation_export"
      and .state == "postcommit_verified"
      and .approval_fingerprint == $fingerprint
      and .receipt.state == "postcommit_verified"
      and .receipt.export.path == $export
      and .receipt.public_foundation_export == true
      and .receipt.root_public_export == true
      and .receipt.production_deploy == false
      and .receipt.service_start == false
      and .receipt.broker_invocation == false
      and .receipt.signing_or_seed_export == false
      and .receipt.private_material_export == false
      and .read_only == true
      and .privileged_replay == false
      and .repeat_privileged_launch == false
      and .production_deploy == false
      and .service_start == false
      and .broker_invocation == false
    ' "$FOUNDATION_RECONCILIATION_RESPONSE" >/dev/null
then
  FOUNDATION_RECONCILIATION_VERIFIED=true
fi

if ! foundation_select_finish_contract; then
  /usr/bin/printf '%s\n' \
    'foundation terminal observation is outside the accepted finish contract' \
    >&2
  exit 77
fi

if ! foundation_finish_until_validated; then
  /usr/bin/printf '%s\n' \
    'foundation finish is not yet durably observable; rerun this exact state directory and attempt without repeating privileged work' \
    >&2
  exit 76
fi
set -e
foundation_validate_finish_response "$FOUNDATION_FINISH_RESPONSE"
foundation_require_verified_success

The wrapper publishes the root journal before export mutation, writes the public result before the receipt, and publishes the receipt last. Its public-custody reconciler needs no private operator file after completion. SHA256SUMS covers exactly the thirteen byte-sorted payload names; the foundation-export.json descriptor is published last inside the export and binds the request, source paths and modes, operator identity, payload commitments, and non-deployment/non-invocation flags. Every incomplete tree remains for quarantine. The signing seed and every other unlisted object are absent by construction.

As the non-root operator, copy those exact public bytes into a new owner-only candidate directory. Use no-clobber destinations and verify the root export before and after the copy:

: "${S22_FOUNDATION_EXPORT:?approved root-owned public export directory}"
umask 077
OPERATOR_FOUNDATION=/secure/s22-measured-foundation-$(date -u +%Y%m%d%H%M%S)
mkdir -m 0700 "$OPERATOR_FOUNDATION"
test "$(stat -c '%u %a' "$OPERATOR_FOUNDATION")" = "$(id -u) 700"

(cd "$S22_FOUNDATION_EXPORT" && sha256sum --check --strict SHA256SUMS)

copy_public_foundation_file() {
  mode=$1
  name=$2
  destination=$OPERATOR_FOUNDATION/$name
  test ! -e "$destination"
  install -T -m "$mode" -- "$S22_FOUNDATION_EXPORT/$name" "$destination"
  test "$(stat -c '%u %a %h' "$destination")" = "$(id -u) $mode 1"
}

copy_public_foundation_file 755 launcher
copy_public_foundation_file 555 preload.so
for name in \
  broker-build-host-trust-anchor.json broker-build-receipt.json \
  aot-build-receipt.json foundation-attestor-policy.json \
  source-manifest.txt runtime-objects-manifest.txt \
  arguments-manifest.txt environment-manifest.txt; do
  copy_public_foundation_file 400 "$name"
done
for name in measured-aot-policy.json bunfig.toml tsconfig.json; do
  copy_public_foundation_file 444 "$name"
done

test ! -e "$S22_FOUNDATION_EXPORT/broker-signing-seed.bin"
test ! -e "$OPERATOR_FOUNDATION/broker-signing-seed.bin"
for name in launcher preload.so broker-build-host-trust-anchor.json \
  broker-build-receipt.json aot-build-receipt.json measured-aot-policy.json \
  foundation-attestor-policy.json \
  source-manifest.txt runtime-objects-manifest.txt arguments-manifest.txt \
  environment-manifest.txt bunfig.toml tsconfig.json; do
  test "$(sha256sum "$S22_FOUNDATION_EXPORT/$name" | cut -d' ' -f1)" \
    = "$(sha256sum "$OPERATOR_FOUNDATION/$name" | cut -d' ' -f1)"
done

S22_LAUNCHER_CANDIDATE="$OPERATOR_FOUNDATION/launcher"
S22_PRELOAD_CANDIDATE="$OPERATOR_FOUNDATION/preload.so"
S22_BROKER_BUILD_HOST_TRUST_ANCHOR=\
"$OPERATOR_FOUNDATION/broker-build-host-trust-anchor.json"
S22_BROKER_BUILD_RECEIPT="$OPERATOR_FOUNDATION/broker-build-receipt.json"
S22_AOT_BUILD_RECEIPT="$OPERATOR_FOUNDATION/aot-build-receipt.json"
S22_MEASURED_AOT_POLICY="$OPERATOR_FOUNDATION/measured-aot-policy.json"
S22_SOURCE_MANIFEST="$OPERATOR_FOUNDATION/source-manifest.txt"
S22_RUNTIME_OBJECTS_MANIFEST="$OPERATOR_FOUNDATION/runtime-objects-manifest.txt"
S22_ARGUMENTS_MANIFEST="$OPERATOR_FOUNDATION/arguments-manifest.txt"
S22_ENVIRONMENT_MANIFEST="$OPERATOR_FOUNDATION/environment-manifest.txt"
S22_FOUNDATION_ATTESTOR_POLICY=\
"$OPERATOR_FOUNDATION/foundation-attestor-policy.json"
S22_BUNFIG_CANDIDATE="$OPERATOR_FOUNDATION/bunfig.toml"
S22_TSCONFIG_CANDIDATE="$OPERATOR_FOUNDATION/tsconfig.json"
export OPERATOR_FOUNDATION S22_LAUNCHER_CANDIDATE S22_PRELOAD_CANDIDATE
export S22_BROKER_BUILD_HOST_TRUST_ANCHOR S22_BROKER_BUILD_RECEIPT
export S22_AOT_BUILD_RECEIPT S22_MEASURED_AOT_POLICY S22_SOURCE_MANIFEST
export S22_RUNTIME_OBJECTS_MANIFEST S22_ARGUMENTS_MANIFEST
export S22_ENVIRONMENT_MANIFEST S22_FOUNDATION_ATTESTOR_POLICY
export S22_BUNFIG_CANDIDATE S22_TSCONFIG_CANDIDATE

Phase one consumes the owner-custodied copies, never the root export directly. The root-frozen source tree, Bun, libc, and loader remain at their signed root-owned paths and must be readable but not writable by the operator.

Freeze the inputs and write the v2 plan

Before rendering, require all of the following:

• the current native broker bundle: launcher mode 0755, preload.so mode 0555, its compact broker build receipt mode 0400, and its reviewed build-host anchor mode 0400;
• a root-frozen-production AOT receipt and measured AOT policy. Development candidates are rejected;
• the exact byte-sorted source manifest and exact source tree, including the emitted .mjs bundle, empty bunfig.toml, minimal tsconfig.json ({}\n), every module, and every trusted asset;
• a byte-sorted runtime-object manifest containing the exact Bun, libc, ELF loader, and final preload paths and digests;
• exact empty policy manifests chorus.s22-measured-arguments/1\n and chorus.s22-measured-environment/1\n; and
• the canonical public-only foundation-attestor policy copied from the exact verified export; its descriptor always names the separately installed fixed root path;
• three future candidate paths for the signed campaign trust policy, signed terminal intent, and measured request. Phase one does not read those three files.

The source root cannot contain the key, receipts, runtime objects, config, campaign authority, publication state, or any other dynamic input. Bun, libc, loader, source, target UID, caller UID, and all candidate paths must be canonical absolute paths. The target UID must be a dedicated account and must differ from the real caller UID: broker startup and failure cleanup send SIGKILL to every process exposing that UID in any real/effective/saved/filesystem credential slot.

Set the following environment values to the reviewed absolute paths. The install.* policy paths below are deliberately fixed under /etc/chorus/s22/m001; the launcher, preload, signing seed, and publication paths cannot be changed by a plan. The preceding seed-custody and public-export steps must already have produced SIGNING_PUBLIC_KEY and the owner-custodied S22_*_CANDIDATE inputs.

set -eu

PLAN=/secure/s22-measured-provision-plan.json
CANDIDATE_PARENT=/secure/s22-measured-candidates
install -d -m 0700 "$CANDIDATE_PARENT"
test "$(stat -c '%u %a' "$CANDIDATE_PARENT")" = "$(id -u) 700"

# Reviewed inputs. All values are canonical absolute paths.
: "${S22_LAUNCHER_CANDIDATE:?}"
: "${S22_PRELOAD_CANDIDATE:?}"
: "${S22_BROKER_BUILD_HOST_TRUST_ANCHOR:?}"
: "${S22_BROKER_BUILD_RECEIPT:?}"
: "${S22_AOT_BUILD_RECEIPT:?}"
: "${S22_MEASURED_AOT_POLICY:?}"
: "${S22_SOURCE_MANIFEST:?}"
: "${S22_RUNTIME_OBJECTS_MANIFEST:?}"
: "${S22_ARGUMENTS_MANIFEST:?}"
: "${S22_ENVIRONMENT_MANIFEST:?}"
: "${S22_FOUNDATION_ATTESTOR_POLICY:?exact owner-custodied public policy copy}"
: "${S22_CAMPAIGN_TRUST_POLICY:?future candidate path}"
: "${S22_TERMINAL_INTENT:?future candidate path}"
: "${S22_REQUEST_MANIFEST:?future candidate path}"
: "${S22_BUNFIG_CANDIDATE:?}"
: "${S22_TSCONFIG_CANDIDATE:?}"
: "${S22_SOURCE_ROOT:?}"
: "${S22_BUN:?}"
: "${S22_LIBC:?}"
: "${S22_LOADER:?}"
: "${S22_TARGET_UID:?dedicated non-root UID}"
: "${S22_TARGET_GID:?dedicated non-root GID}"
: "${S22_ALLOWED_CALLER_UID:?non-root real caller UID}"
: "${S22_TIMEOUT_SECONDS:?1 through 86400}"
: "${SIGNING_PUBLIC_KEY:?64 lowercase hex characters}"

export S22_LAUNCHER_CANDIDATE S22_PRELOAD_CANDIDATE
export S22_BROKER_BUILD_HOST_TRUST_ANCHOR S22_BROKER_BUILD_RECEIPT
export S22_AOT_BUILD_RECEIPT S22_MEASURED_AOT_POLICY S22_SOURCE_MANIFEST
export S22_RUNTIME_OBJECTS_MANIFEST S22_ARGUMENTS_MANIFEST
export S22_ENVIRONMENT_MANIFEST S22_FOUNDATION_ATTESTOR_POLICY
export S22_CAMPAIGN_TRUST_POLICY S22_TERMINAL_INTENT
export S22_REQUEST_MANIFEST S22_BUNFIG_CANDIDATE S22_TSCONFIG_CANDIDATE
export S22_SOURCE_ROOT S22_BUN S22_LIBC S22_LOADER
export S22_TARGET_UID S22_TARGET_GID S22_ALLOWED_CALLER_UID S22_TIMEOUT_SECONDS
export SIGNING_PUBLIC_KEY
export VERIFICATION_TIME
VERIFICATION_TIME=$(bun -e 'process.stdout.write(new Date().toISOString())')

jq -cn '
  {
    schema_version:"chorus.s22-measured-broker-provision-plan/2",
    verification_time:env.VERIFICATION_TIME,
    signing_public_key:env.SIGNING_PUBLIC_KEY,
    inputs:{
      launcher:env.S22_LAUNCHER_CANDIDATE,
      preload:env.S22_PRELOAD_CANDIDATE,
      broker_build_host_trust_anchor:env.S22_BROKER_BUILD_HOST_TRUST_ANCHOR,
      broker_build_receipt:env.S22_BROKER_BUILD_RECEIPT,
      aot_build_receipt:env.S22_AOT_BUILD_RECEIPT,
      measured_aot_policy:env.S22_MEASURED_AOT_POLICY,
      source_manifest:env.S22_SOURCE_MANIFEST,
      runtime_objects_manifest:env.S22_RUNTIME_OBJECTS_MANIFEST,
      arguments_manifest:env.S22_ARGUMENTS_MANIFEST,
      environment_manifest:env.S22_ENVIRONMENT_MANIFEST,
      foundation_attestor_policy:env.S22_FOUNDATION_ATTESTOR_POLICY,
      campaign_trust_policy:env.S22_CAMPAIGN_TRUST_POLICY,
      terminal_intent:env.S22_TERMINAL_INTENT,
      request_manifest:env.S22_REQUEST_MANIFEST,
      bunfig:env.S22_BUNFIG_CANDIDATE,
      tsconfig:env.S22_TSCONFIG_CANDIDATE
    },
    install:{
      launcher_path:"/usr/local/libexec/chorus/s22/m001/launcher",
      preload_path:"/usr/local/libexec/chorus/s22/m001/preload.so",
      signing_private_key_path:"/etc/chorus/s22/m001/broker-signing-seed.bin",
      measured_aot_policy_path:"/etc/chorus/s22/m001/measured-launch-policy.json",
      policy_digest_path:"/etc/chorus/s22/m001/measured-launch-policy.sha256",
      source_manifest_path:"/etc/chorus/s22/m001/measured-source-manifest.txt",
      runtime_objects_manifest_path:"/etc/chorus/s22/m001/runtime-objects-manifest.txt",
      arguments_manifest_path:"/etc/chorus/s22/m001/arguments-manifest.txt",
      environment_manifest_path:"/etc/chorus/s22/m001/environment-manifest.txt",
      source_root:env.S22_SOURCE_ROOT,
      bun_path:env.S22_BUN,
      libc_path:env.S22_LIBC,
      loader_path:env.S22_LOADER,
      bunfig_path:(env.S22_SOURCE_ROOT + "/bunfig.toml"),
      tsconfig_path:(env.S22_SOURCE_ROOT + "/tsconfig.json"),
      publication_parent:"/var/lib/chorus/s22/m001",
      publication_name:"publication",
      target_uid:(env.S22_TARGET_UID|tonumber),
      target_gid:(env.S22_TARGET_GID|tonumber),
      allowed_caller_uid:(env.S22_ALLOWED_CALLER_UID|tonumber),
      timeout_seconds:(env.S22_TIMEOUT_SECONDS|tonumber)
    }
  }
' >"$PLAN"
chmod 0600 "$PLAN"
test "$(jq -c . "$PLAN")" = "$(tr -d '\n' <"$PLAN")"

verification_time is a replay guard, not an operator-controlled authority clock. Finalization uses the real current clock and rejects a plan more than five minutes away. If that window expires, create a new plan and phase-one candidate; never edit a candidate receipt in place. Re-review the new plan digest and runtime-policy digest under whatever approval fingerprint governs the signing workflow.

Phase one: render the runtime-policy candidate

Run this as the non-root operator using only the owner-custodied public foundation above. It replays the exact current native build-receipt schema, root-frozen AOT schema, source closure, runtime object set, capability constants, UID separation, and Ed25519 public-key encoding. It writes no fixed path.

RUNTIME_RESULT=$(
  bun scripts/generate-s22-measured-provision.ts render-runtime \
    --plan "$PLAN" \
    --output-parent "$CANDIDATE_PARENT"
)
RUNTIME_CANDIDATE=$(printf '%s\n' "$RUNTIME_RESULT" | jq -er \
  'select(.authoritative == false and .approval_required == true
    and .root_operations_performed == false and .broker_invoked == false)
   | .candidate_directory')

test "$(stat -c '%u %a' "$RUNTIME_CANDIDATE")" = "$(id -u) 700"
test "$(sha256sum "$RUNTIME_CANDIDATE/broker-runtime-policy.json" | cut -d' ' -f1)" \
  = "$(tr -d '\n' <"$RUNTIME_CANDIDATE/broker-runtime-policy.sha256")"
jq . "$RUNTIME_CANDIDATE/foundation-receipt.json"

The signed trust-policy candidate must now bind all four exact build commitments, the runtime-policy SHA-256 and byte length, the raw broker public key, and /var/lib/chorus/s22/m001/publication. The terminal intent must bind that exact trust policy, the exact measured request, the same build/broker tuple, and the exact mode-0444 measured AOT policy. The measured request must bind the intent ID, epoch, trust digest, terminal marker, inputs, and candidates. The pre-campaign trust envelope must satisfy the disjoint foundation-attestor quorum. The later terminal-intent envelope must satisfy the independent governance review and risk quorums. Both contain production_deploy: false and orchestrator_production_deployment_command_invoked: false.

These later request/intent requirements are stated here only to freeze the cross-binding; do not construct or sign them before final B exists. Produce the trust candidate now through the reviewed foundation-attestor process below, never by editing JSON after a signature, and seal it at mode 0400. The completion section produces the measured request and terminal intent at mode 0400 after final B. The provisioned Sophie/Aurora reviewer policy supplies no pre-campaign signature.

Create and foundation-attest campaign trust

Prepare an owner-only trust request containing every field of chorus.s22-campaign-trust-policy-payload/2 except schema_version. It binds the new campaign ID/path, immutable image digest, exact before-governance descriptor, provisioned reviewer policy as unsigned metadata, the exact fixed foundation-attestor policy descriptor, broker public key/publication directory, phase-one runtime policy commitment, and the exact measured source, AOT policy, AOT receipt, and native broker receipt commitments. The validity window is at most 90 days, includes the real campaign execution time, and both production flags remain false.

Create canonical payload bytes, then have each independently custodied foundation attestor sign the one v2 foundation domain. A private key file must be owned by that attestor process with mode 0400 or 0600; the command clears its key buffer and never copies key material into an output. The attestor key IDs and identity IDs are disjoint from the embedded reviewer, risk-approver, operator, and forbidden identity sets. A governance reviewer does not sign this payload before provisional evidence exists.

TRUST_REQUEST=/secure/s22-campaign-trust-request.json
TRUST_PAYLOAD=/secure/s22-campaign-trust-payload.json
TRUST_ASSEMBLY=/secure/s22-campaign-trust-assembly.json
TRUST_CANDIDATE=/secure/campaign-trust-policy.json
: "${S22_FOUNDATION_ATTESTOR_POLICY:?exact owner-custodied copy of fixed policy bytes}"
FOUNDATION_ATTESTOR_POLICY=$S22_FOUNDATION_ATTESTOR_POLICY
NOW=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)

bun run scripts/s22-root-authority-tools.ts trust-payload \
  --request "$TRUST_REQUEST" \
  --foundation-attestor-policy "$FOUNDATION_ATTESTOR_POLICY" \
  --output "$TRUST_PAYLOAD"

bun run scripts/s22-root-authority-tools.ts trust-sign \
  --payload "$TRUST_PAYLOAD" \
  --foundation-attestor-policy "$FOUNDATION_ATTESTOR_POLICY" \
  --private-key /secure/foundation-attestor-a.pk8.pem \
  --output /secure/trust-foundation-attestor-a.signature.json

# Repeat once for every independent foundation attestor. The assembly request
# has exactly: payload, foundation_signatures.
bun run scripts/s22-root-authority-tools.ts trust-assemble \
  --request "$TRUST_ASSEMBLY" \
  --foundation-attestor-policy "$FOUNDATION_ATTESTOR_POLICY" \
  --now "$NOW" \
  --output "$TRUST_CANDIDATE"

bun run scripts/s22-root-authority-tools.ts trust-verify \
  --authority "$TRUST_CANDIDATE" \
  --foundation-attestor-policy "$FOUNDATION_ATTESTOR_POLICY" \
  --now "$NOW"

trust-assemble sorts detached signatures by key ID, requires distinct eligible foundation-attestor quorum, rechecks every role-separation boundary, authenticates the validity window, and writes exact canonical bytes to a new mode-0400 file. It cannot mint fixed-path production authority; only the separately approved root publication below can do that.

Install four fixed campaign-start files and publish the public authority snapshot

Use the exact four reviewed candidates already placed by the approved foundation workflow in one root-owned, mode-0700 input directory. Each source is root:root, single-linked, mode 0400, and has its fixed basename. Do not copy, replace, or create those inputs in this step.

The production action wrapper is scripts/s22-campaign-start-publication-execution.ts. It binds the four inputs, the pre-existing fixed foundation-attestor policy, all four fixed destinations, the inner journal and receipt, the measured Bun/executor/import closure, the approval verifier and key set, both execution schemas, and one exact eight-entry public transaction. The public transaction contains readable mode-0444 copies of all five authority documents, their canonical campaign-authority-snapshot.json, result.json, and the last-published receipt.json. Campaign start opens and authenticates all eight entries, requires distinct file identities, requires the result and receipt to be identical canonical v2 execution receipts bound to the snapshot and five copies, and persists the exact result and receipt facts beside the snapshot fact for later replay. Its approval-payload command has one explicit supervised root measurement mode because a non-root operator cannot read root:root mode-0400 inputs. That read-only measurement and the wrapper’s exclusive operator-owned approval publication are the only direct sudo invocation below. Every later step is non-root or runs an argv emitted by the verified launch publication.

The order is fail closed:

supervised approval measurement → independent fingerprint → high-risk gate → human approval → signed execution begin → exclusive launch-start → verified emitted privileged argv once → emitted read-only reconciliation → execution finish.

Never invoke s22-campaign-start-publication.ts directly, reconstruct its fingerprint or publish command, manually copy a fixed destination, display the approval capability, repeat a launch, start a service, invoke the broker, or deploy. The wrapper publishes the root journal before any inner mutation, publishes all five authority copies before the canonical snapshot, writes the immutable public result after the snapshot, and the public receipt is published last. Its inner state paths remain exactly s22-campaign-start-publication-journal.json and s22-campaign-start-publication-receipt.json; operators never construct either file.

On first execution, use a not-yet-existing owner-only state directory and one stable attempt ID. To recover after an interruption or a lost accepted response, rerun this same block with the exact same directory, flow ID, attempt ID, and inputs. Recovery reuses append-only observations, retries only the same idempotent begin or finish, and never repeats the supervised approval measurement, creates or approves a replacement gate, or dispatches the privileged argv after launch-start is fenced. The helpers retry the same stable attempt ID and recover its exact accepted revision. Every accepted begin is driven to a validated terminal finish for that exact revision; the helpers finalize failed or incomplete reconciliation as terminal failure.

An observed_in_flight response recovers the accepted revision but does not authorize launch; only the matching signed begin attestation does. An observed_completed response permanently suppresses launch, recovers the preceding accepted revision, and is confirmed through the same idempotent finish call.

: "${S22_ROOT_BUN:?root-owned reviewed Bun}"
: "${S22_ROOT_BUILDER:?root-owned reviewed builder tree}"
: "${CAMPAIGN_START_EXECUTION_STATE:?canonical owner-only state directory; reuse for recovery}"
: "${CAMPAIGN_START_FLOW_ID:?fresh lowercase evidence identifier}"
: "${CAMPAIGN_START_ATTEMPT_ID:?stable attempt ID for this exact action}"
: "${APPROVER_IDENTITY:?explicit human approver identity}"

set -euo pipefail
umask 077
[[ $CAMPAIGN_START_FLOW_ID =~ ^[a-z0-9][a-z0-9-]{0,63}$ ]]
CAMPAIGN_RECOVERY_MODE=false
if [[ -e $CAMPAIGN_START_EXECUTION_STATE \
  && ! -L $CAMPAIGN_START_EXECUTION_STATE ]]
then
  CAMPAIGN_RECOVERY_MODE=true
else
  test ! -e "$CAMPAIGN_START_EXECUTION_STATE" \
    -a ! -L "$CAMPAIGN_START_EXECUTION_STATE"
  /usr/bin/mkdir -m 0700 -- "$CAMPAIGN_START_EXECUTION_STATE"
fi
test "$(/usr/bin/realpath -e -- "$CAMPAIGN_START_EXECUTION_STATE")" = \
  "$CAMPAIGN_START_EXECUTION_STATE"
CAMPAIGN_OPERATOR_UID=$(/usr/bin/id -u)
CAMPAIGN_OPERATOR_GID=$(/usr/bin/id -g)
test "$CAMPAIGN_OPERATOR_UID" -ne 0
test "$(/usr/bin/stat -Lc '%a %u %g' -- \
  "$CAMPAIGN_START_EXECUTION_STATE")" = \
  "700 $CAMPAIGN_OPERATOR_UID $CAMPAIGN_OPERATOR_GID"

CAMPAIGN_START_INPUTS=/secure/root-s22-campaign-start-inputs
TRUST_ROOT_INPUT=$CAMPAIGN_START_INPUTS/campaign-trust-policy.json
RUNTIME_ROOT_INPUT=$CAMPAIGN_START_INPUTS/broker-runtime-policy.json
BROKER_BUILD_ROOT_INPUT=$CAMPAIGN_START_INPUTS/broker-build-receipt.json
AOT_BUILD_ROOT_INPUT=$CAMPAIGN_START_INPUTS/aot-build-receipt.json
CAMPAIGN_ACTION=\
$CAMPAIGN_START_EXECUTION_STATE/s22-campaign-start-publication-execution-approval.json
CAMPAIGN_APPROVAL_ATTESTATION=\
$CAMPAIGN_START_EXECUTION_STATE/s22-campaign-start-publication-execution-approval-begin-attestation.json
CAMPAIGN_LAUNCH_START=\
$CAMPAIGN_START_EXECUTION_STATE/s22-campaign-start-publication-execution-launch-start.json
CAMPAIGN_APPROVAL_PAYLOAD_RESPONSE=\
$CAMPAIGN_START_EXECUTION_STATE/approval-payload-$CAMPAIGN_START_FLOW_ID.json
CAMPAIGN_GATE_REQUEST=\
$CAMPAIGN_START_EXECUTION_STATE/gate-request-$CAMPAIGN_START_FLOW_ID.json
CAMPAIGN_GATE_CREATE=\
$CAMPAIGN_START_EXECUTION_STATE/gate-create-$CAMPAIGN_START_FLOW_ID.json
CAMPAIGN_APPROVAL_RESPONSE=\
$CAMPAIGN_START_EXECUTION_STATE/approval-response-$CAMPAIGN_START_FLOW_ID.json
CAMPAIGN_BEGIN_RESPONSE_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/begin-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_BEGIN_RESPONSE=
CAMPAIGN_LAUNCH_PUBLICATION=\
$CAMPAIGN_START_EXECUTION_STATE/launch-publication-$CAMPAIGN_START_FLOW_ID.json
CAMPAIGN_VERIFIED_LAUNCH_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/verified-launch-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_VERIFIED_LAUNCH=
CAMPAIGN_PRIVILEGED_ARGV_NUL_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/privileged-argv-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_PRIVILEGED_ARGV_NUL=
CAMPAIGN_RECONCILIATION_ARGV_NUL_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/reconciliation-argv-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_RECONCILIATION_ARGV_NUL=
CAMPAIGN_ROOT_RESULT=\
$CAMPAIGN_START_EXECUTION_STATE/root-result-$CAMPAIGN_START_FLOW_ID.txt
CAMPAIGN_RECONCILIATION_RESPONSE_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/reconciliation-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_RECONCILIATION_RESPONSE=
CAMPAIGN_FINISH_RESPONSE_PREFIX=\
$CAMPAIGN_START_EXECUTION_STATE/finish-$CAMPAIGN_START_FLOW_ID-
CAMPAIGN_FINISH_RESPONSE=
CAMPAIGN_BEGIN_RETRY_LIMIT=8
CAMPAIGN_FINISH_RETRY_LIMIT=8
CAMPAIGN_EXECUTION_TOOL=\
$S22_ROOT_BUILDER/scripts/s22-campaign-start-publication-execution.ts
CAMPAIGN_EXECUTOR=\
$S22_ROOT_BUILDER/scripts/s22-campaign-start-publication-executor.sh
CAMPAIGN_APPROVAL_SCHEMA=\
$S22_ROOT_BUILDER/schemas/audit/s22-campaign-start-publication-execution-approval-v2.schema.json
CAMPAIGN_RECEIPT_SCHEMA=\
$S22_ROOT_BUILDER/schemas/audit/s22-campaign-start-publication-execution-receipt-v2.schema.json
APPROVAL_ATTESTATION_VERIFIER=\
/usr/local/libexec/chorus/s22/approval-begin-v1/verifier
APPROVAL_ATTESTATION_KEY_DIRECTORY=\
/etc/chorus/approval-execution-attestation/v1/keys
mapfile -t CAMPAIGN_APPROVAL_ATTESTATION_KEYS < <(
  /usr/bin/find "$APPROVAL_ATTESTATION_KEY_DIRECTORY" -maxdepth 1 -type f \
    -name 'ed25519-sha256-*.spki' -printf '%p\n' | LC_ALL=C /usr/bin/sort
)
[[ ${#CAMPAIGN_APPROVAL_ATTESTATION_KEYS[@]} -ge 1 \
  && ${#CAMPAIGN_APPROVAL_ATTESTATION_KEYS[@]} -le 2 ]]
CAMPAIGN_APPROVAL_ATTESTATION_KEYS_CSV=$(
  IFS=,
  /usr/bin/printf '%s' "${CAMPAIGN_APPROVAL_ATTESTATION_KEYS[*]}"
)

run_campaign_execution_tool() {
  /usr/bin/env -i \
    PATH=/usr/bin:/bin:/usr/sbin:/sbin LANG=C LC_ALL=C TZ=UTC \
    HOME=/nonexistent XDG_CONFIG_HOME=/nonexistent \
    BUN_JSC_useJIT=false BUN_JSC_useRegExpJIT=false \
    BUN_JSC_useWasm=false \
    "$S22_ROOT_BUN" --no-install --no-env-file --config=/dev/null --cwd=/ \
    "$CAMPAIGN_EXECUTION_TOOL" "$@"
}

# BEGIN CAMPAIGN_DURABLE_ATTEMPT_HELPERS
campaign_next_observation_path() {
  local prefix=$1
  local limit=$2
  local index sequence candidate
  for ((index = 1; index <= limit; index++)); do
    printf -v sequence '%06d' "$index"
    candidate=${prefix}${sequence}.json
    if [[ ! -e $candidate && ! -L $candidate ]]; then
      CAMPAIGN_NEXT_OBSERVATION=$candidate
      return 0
    fi
  done
  return 1
}

campaign_execution_begin_cli() {
  local attestation_output=$1
  local attestation_args=()
  if [[ -n $attestation_output ]]; then
    attestation_args=(--attestation-output "$attestation_output")
  fi
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals execution begin --profile inu \
    --attempt-id "$CAMPAIGN_START_ATTEMPT_ID" \
    --approval-response "$CAMPAIGN_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
    "${attestation_args[@]}" --json
}

campaign_validate_begin_response() {
  local response=$1
  local revision response_revision status
  /usr/bin/jq -e \
    --arg gate "$CAMPAIGN_GATE_ID" \
    --arg attempt "$CAMPAIGN_START_ATTEMPT_ID" \
    --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" '
      .attempt.gate_id == $gate
      and .attempt.attempt_id == $attempt
      and .attempt.request_fingerprint == $fingerprint
      and (.attempt.revision | type == "number" and floor == .
        and . >= 1 and . <= 2147483647)
      and (
        (
          (
            (.status == "accepted" and .attempt.revision == 1)
            or (.status == "resumed" and .attempt.revision >= 2)
          )
          and .execution_authorized == true
          and .attempt.state == "accepted"
          and .attempt.completed_at == null
          and .attempt.last_error == null
        )
        or (
          .status == "observed_in_flight"
          and .execution_authorized == false
          and .attempt.state == "accepted"
          and .attempt.completed_at == null
          and .attempt.last_error == null
        )
        or (
          .status == "observed_completed"
          and .execution_authorized == false
          and .attempt.revision >= 2
          and (.attempt.completed_at | type == "string" and length > 0)
          and (
            (.attempt.state == "succeeded" and .attempt.last_error == null)
            or (
              .attempt.state == "abandoned"
              and (.attempt.last_error | type == "string"
                and length > 0 and length <= 128)
            )
          )
        )
      )
    ' "$response" >/dev/null || return 1
  status=$(/usr/bin/jq -er '.status' "$response") || return 1
  response_revision=$(
    /usr/bin/jq -er '.attempt.revision' "$response"
  ) || return 1
  if [[ $status == observed_completed ]]; then
    revision=$((response_revision - 1))
  else
    revision=$response_revision
  fi
  [[ $revision =~ ^[1-9][0-9]*$ ]] || return 1
  if [[ $CAMPAIGN_REVISION_SAFE != true \
    || $revision -gt $CAMPAIGN_APPROVAL_REVISION \
    || ( $revision -eq $CAMPAIGN_APPROVAL_REVISION \
      && $status == observed_completed ) ]]
  then
    CAMPAIGN_BEGIN_RESPONSE=$response
    CAMPAIGN_APPROVAL_REVISION=$revision
    CAMPAIGN_BEGIN_OBSERVED_TERMINAL=false
    CAMPAIGN_BEGIN_TERMINAL_STATE=
    CAMPAIGN_BEGIN_TERMINAL_ERROR=
    if [[ $status == observed_completed ]]; then
      CAMPAIGN_BEGIN_OBSERVED_TERMINAL=true
      CAMPAIGN_BEGIN_TERMINAL_STATE=$(
        /usr/bin/jq -er '.attempt.state' "$response"
      ) || return 1
      CAMPAIGN_BEGIN_TERMINAL_ERROR=$(
        /usr/bin/jq -er '.attempt.last_error // ""' "$response"
      ) || return 1
    fi
    CAMPAIGN_REVISION_SAFE=true
  fi
}

campaign_recover_begin_revision() {
  local response attestation_output retry
  CAMPAIGN_REVISION_SAFE=false
  CAMPAIGN_BEGIN_READY=false
  CAMPAIGN_BEGIN_OBSERVED_TERMINAL=false
  CAMPAIGN_BEGIN_TERMINAL_STATE=
  CAMPAIGN_BEGIN_TERMINAL_ERROR=
  CAMPAIGN_APPROVAL_REVISION=
  CAMPAIGN_BEGIN_RESPONSE=

  for response in "${CAMPAIGN_BEGIN_RESPONSE_PREFIX}"*.json; do
    [[ -f $response && ! -L $response ]] || continue
    campaign_validate_begin_response "$response" || true
  done

  for ((retry = 1; retry <= CAMPAIGN_BEGIN_RETRY_LIMIT; retry++)); do
    [[ $CAMPAIGN_REVISION_SAFE != true ]] || break
    campaign_next_observation_path \
      "$CAMPAIGN_BEGIN_RESPONSE_PREFIX" 1024 || return 1
    response=$CAMPAIGN_NEXT_OBSERVATION
    if [[ ! -e $CAMPAIGN_APPROVAL_ATTESTATION \
      && ! -L $CAMPAIGN_APPROVAL_ATTESTATION ]]
    then
      attestation_output=$CAMPAIGN_APPROVAL_ATTESTATION
    elif [[ -f $CAMPAIGN_APPROVAL_ATTESTATION \
      && ! -L $CAMPAIGN_APPROVAL_ATTESTATION ]]
    then
      attestation_output=
    else
      return 1
    fi
    if ( set -o noclobber
      campaign_execution_begin_cli "$attestation_output" >"$response"
    ); then
      CAMPAIGN_BEGIN_COMMAND_STATUS=0
    else
      CAMPAIGN_BEGIN_COMMAND_STATUS=$?
    fi
    campaign_validate_begin_response "$response" || true
  done
  [[ $CAMPAIGN_REVISION_SAFE == true ]] || return 1

  if test "$(/usr/bin/stat -Lc '%a %u %g %h' -- \
    "$CAMPAIGN_APPROVAL_ATTESTATION" 2>/dev/null)" = \
    "600 $(/usr/bin/id -u) $(/usr/bin/id -g) 1" \
    && /usr/bin/jq -e \
      --arg type host.s22_campaign_start_publication \
      --arg gate "$CAMPAIGN_GATE_ID" \
      --arg attempt "$CAMPAIGN_START_ATTEMPT_ID" \
      --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
      --argjson revision "$CAMPAIGN_APPROVAL_REVISION" '
        .attestation.payload.gate_action_type == $type
        and .attestation.payload.gate_id == $gate
        and .attestation.payload.execution_authorized == true
        and .attestation.payload.attempt.attempt_id == $attempt
        and .attestation.payload.attempt.request_fingerprint == $fingerprint
        and .attestation.payload.attempt.revision == $revision
        and (.attestation.signature_base64url | type == "string" and length > 0)
      ' "$CAMPAIGN_APPROVAL_ATTESTATION" >/dev/null
  then
    CAMPAIGN_BEGIN_READY=true
  fi
}

campaign_dispatch_new_launch_once() {
  CAMPAIGN_ROOT_STATUS=125
  if [[ $CAMPAIGN_NEW_LAUNCH == true && $CAMPAIGN_VECTOR_STATUS == 0 ]]; then
    ( set -o noclobber
      "${CAMPAIGN_PRIVILEGED_ARGV[@]}" >"$CAMPAIGN_ROOT_RESULT"
    )
    CAMPAIGN_ROOT_STATUS=$?
  fi
}

campaign_execution_finish_cli() {
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals execution finish --profile inu \
    --attempt-id "$CAMPAIGN_START_ATTEMPT_ID" \
    --approval-response "$CAMPAIGN_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
    --revision "$CAMPAIGN_APPROVAL_REVISION" \
    --outcome "$CAMPAIGN_OUTCOME" "${CAMPAIGN_ERROR_ARGS[@]}" \
    --json
}

campaign_validate_finish_response() {
  local response=$1
  /usr/bin/jq -e \
    --arg gate "$CAMPAIGN_GATE_ID" \
    --arg attempt "$CAMPAIGN_START_ATTEMPT_ID" \
    --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
    --arg state "$CAMPAIGN_EXPECTED_STATE" \
    --arg error "$CAMPAIGN_ERROR" \
    --argjson revision "$CAMPAIGN_APPROVAL_REVISION" '
      (.status == "finished" or .status == "idempotent")
      and .execution_authorized == false
      and .attempt.gate_id == $gate
      and .attempt.attempt_id == $attempt
      and .attempt.request_fingerprint == $fingerprint
      and .attempt.state == $state
      and .attempt.revision == ($revision + 1)
      and (.attempt.completed_at | type == "string")
      and (if $state == "succeeded" then .attempt.last_error == null
           else .attempt.last_error == $error end)
    ' "$response" >/dev/null
}

campaign_finish_until_validated() {
  local response retry
  CAMPAIGN_FINISH_RESPONSE=
  for response in "${CAMPAIGN_FINISH_RESPONSE_PREFIX}"*.json; do
    [[ -f $response && ! -L $response ]] || continue
    if campaign_validate_finish_response "$response"; then
      CAMPAIGN_FINISH_RESPONSE=$response
      return 0
    fi
  done
  for ((retry = 1; retry <= CAMPAIGN_FINISH_RETRY_LIMIT; retry++)); do
    campaign_next_observation_path \
      "$CAMPAIGN_FINISH_RESPONSE_PREFIX" 1024 || return 1
    response=$CAMPAIGN_NEXT_OBSERVATION
    if ( set -o noclobber
      campaign_execution_finish_cli >"$response"
    ); then
      CAMPAIGN_FINISH_STATUS=0
    else
      CAMPAIGN_FINISH_STATUS=$?
    fi
    if campaign_validate_finish_response "$response"; then
      CAMPAIGN_FINISH_RESPONSE=$response
      return 0
    fi
  done
  return 1
}

campaign_select_finish_contract() {
  if [[ $CAMPAIGN_BEGIN_OBSERVED_TERMINAL == true ]]; then
    if [[ $CAMPAIGN_BEGIN_TERMINAL_STATE == succeeded \
      && -z $CAMPAIGN_BEGIN_TERMINAL_ERROR ]]
    then
      CAMPAIGN_OUTCOME=succeeded
      CAMPAIGN_EXPECTED_STATE=succeeded
      CAMPAIGN_ERROR=
      CAMPAIGN_ERROR_ARGS=()
      return 0
    fi
    if [[ $CAMPAIGN_BEGIN_TERMINAL_STATE == abandoned \
      && -n $CAMPAIGN_BEGIN_TERMINAL_ERROR ]]
    then
      CAMPAIGN_OUTCOME=terminal_failure
      CAMPAIGN_EXPECTED_STATE=abandoned
      CAMPAIGN_ERROR=$CAMPAIGN_BEGIN_TERMINAL_ERROR
      CAMPAIGN_ERROR_ARGS=(--error "$CAMPAIGN_ERROR")
      return 0
    fi
    return 1
  fi

  if [[ $CAMPAIGN_RECONCILIATION_VERIFIED == true ]]; then
    CAMPAIGN_OUTCOME=succeeded
    CAMPAIGN_EXPECTED_STATE=succeeded
    CAMPAIGN_ERROR=
    CAMPAIGN_ERROR_ARGS=()
  else
    CAMPAIGN_OUTCOME=terminal_failure
    CAMPAIGN_EXPECTED_STATE=abandoned
    CAMPAIGN_ERROR=campaign_start_publication_not_verified
    CAMPAIGN_ERROR_ARGS=(--error "$CAMPAIGN_ERROR")
  fi
}

campaign_require_verified_success() {
  test "$CAMPAIGN_EXPECTED_STATE" = succeeded \
    && test "$CAMPAIGN_RECONCILIATION_VERIFIED" = true
}
# END CAMPAIGN_DURABLE_ATTEMPT_HELPERS

if [[ $CAMPAIGN_RECOVERY_MODE == false ]]; then
# This is the wrapper's explicit supervised root measurement mode. It reads the
# four root:root mode-0400 inputs, the fixed foundation-attestor policy, and the
# root authority closure, then exclusively
# publishes only the operator-owned approval payload. It does not touch a fixed
# destination, journal, receipt, service, broker, or deployment.
( set -o noclobber
  /usr/bin/sudo -H /usr/bin/env -i \
    PATH=/usr/bin:/bin:/usr/sbin:/sbin LANG=C LC_ALL=C TZ=UTC \
    HOME=/nonexistent XDG_CONFIG_HOME=/nonexistent \
    BUN_JSC_useJIT=false BUN_JSC_useRegExpJIT=false \
    BUN_JSC_useWasm=false \
    "$S22_ROOT_BUN" --no-install --no-env-file --config=/dev/null --cwd=/ \
    "$CAMPAIGN_EXECUTION_TOOL" approval-payload \
  --trust "$TRUST_ROOT_INPUT" \
  --runtime "$RUNTIME_ROOT_INPUT" \
  --broker-build "$BROKER_BUILD_ROOT_INPUT" \
  --aot-build "$AOT_BUILD_ROOT_INPUT" \
    --bun "$S22_ROOT_BUN" \
    --action-tool "$CAMPAIGN_EXECUTION_TOOL" \
    --executor "$CAMPAIGN_EXECUTOR" \
    --approval-schema "$CAMPAIGN_APPROVAL_SCHEMA" \
    --receipt-schema "$CAMPAIGN_RECEIPT_SCHEMA" \
    --approval-attestation-verifier "$APPROVAL_ATTESTATION_VERIFIER" \
    --approval-attestation-keys "$CAMPAIGN_APPROVAL_ATTESTATION_KEYS_CSV" \
    --operator-uid "$CAMPAIGN_OPERATOR_UID" \
    --operator-gid "$CAMPAIGN_OPERATOR_GID" \
    --output "$CAMPAIGN_ACTION" \
    >"$CAMPAIGN_APPROVAL_PAYLOAD_RESPONSE"
)
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$CAMPAIGN_ACTION")" = \
  "600 $CAMPAIGN_OPERATOR_UID $CAMPAIGN_OPERATOR_GID 1"
CAMPAIGN_EXPECTED_FINGERPRINT=$(
  run_campaign_execution_tool fingerprint --approval "$CAMPAIGN_ACTION"
)
[[ $CAMPAIGN_EXPECTED_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
/usr/bin/jq -e \
  --arg action "$CAMPAIGN_ACTION" \
  --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" '
    .action_type == "host.s22_campaign_start_publication"
    and .approval_path == $action
    and .request_fingerprint == $fingerprint
    and .authoritative == false
    and .approval_required == true
    and .root_operations_performed == false
    and .production_deploy == false
  ' "$CAMPAIGN_APPROVAL_PAYLOAD_RESPONSE" >/dev/null
/usr/bin/jq -e '
    .schema_version ==
      "chorus.s22-campaign-start-publication-execution-approval/2"
    and .action_type == "host.s22_campaign_start_publication"
    and .foundation_attestor_policy.path ==
      "/etc/chorus/s22/m001/foundation-attestor-policy.json"
    and .public_authority.snapshot_path == .state_paths.public_snapshot
    and .public_authority.snapshot_schema_version ==
      "chorus.s22-campaign-public-authority-snapshot/1"
    and .public_authority.publication_order == [
      "foundation-attestor-policy.json",
      "campaign-trust-policy.json",
      "broker-runtime-policy.json",
      "broker-build-receipt.json",
      "aot-build-receipt.json",
      "campaign-authority-snapshot.json",
      "result.json",
      "receipt.json"
    ]
    and .public_authority.campaign_start_authority == true
    and .public_authority.terminal_authority == false
    and .allowed_result.campaign_start_publication == true
    and .allowed_result.fixed_authority_publication == true
    and .allowed_result.read_only_reconciliation == true
    and .allowed_result.broker_invocation == false
    and .allowed_result.service_start == false
    and .allowed_result.production_deploy == false
    and .allowed_result.production_traffic == false
    and .allowed_result.external_network_access == false
  ' "$CAMPAIGN_ACTION" >/dev/null

( set -o noclobber
  /usr/bin/jq -nS \
    --arg type host.s22_campaign_start_publication \
    --arg summary \
      "Publish four fixed campaign-start authorities plus one five-document public snapshot; no service, broker, traffic, or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$CAMPAIGN_ACTION" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "high",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    ' >"$CAMPAIGN_GATE_REQUEST"
)
( set -o noclobber
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals create --profile inu --from-file "$CAMPAIGN_GATE_REQUEST" \
    --json >"$CAMPAIGN_GATE_CREATE"
)
/usr/bin/jq -e \
  --arg type host.s22_campaign_start_publication \
  --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
  --slurpfile action "$CAMPAIGN_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and .status == "pending"
  ' "$CAMPAIGN_GATE_CREATE" >/dev/null
CAMPAIGN_GATE_ID=$(/usr/bin/jq -er '.id' "$CAMPAIGN_GATE_CREATE")

# HUMAN CHECKPOINT: inspect CAMPAIGN_ACTION, then Inu runs this exact command once.
# The response remains owner-only and its capability is never printed or pasted.
( set -o noclobber
  "$S22_ROOT_BUN" "$S22_ROOT_BUILDER/packages/cli/src/index.ts" \
    approvals approve "$CAMPAIGN_GATE_ID" --profile inu \
    --note "I authorize these four fixed campaign-start destinations plus the exact five-document public authority snapshot, with no service start, broker invocation, traffic, or deployment." \
    --json >"$CAMPAIGN_APPROVAL_RESPONSE"
)
else
  for CAMPAIGN_REQUIRED_STATE in \
    "$CAMPAIGN_ACTION" "$CAMPAIGN_APPROVAL_PAYLOAD_RESPONSE" \
    "$CAMPAIGN_GATE_REQUEST" "$CAMPAIGN_GATE_CREATE" \
    "$CAMPAIGN_APPROVAL_RESPONSE"
  do
    test -f "$CAMPAIGN_REQUIRED_STATE" -a ! -L "$CAMPAIGN_REQUIRED_STATE"
  done
fi

test "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$CAMPAIGN_ACTION")" = \
  "600 $CAMPAIGN_OPERATOR_UID $CAMPAIGN_OPERATOR_GID 1"
CAMPAIGN_EXPECTED_FINGERPRINT=$(
  run_campaign_execution_tool fingerprint --approval "$CAMPAIGN_ACTION"
)
[[ $CAMPAIGN_EXPECTED_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
/usr/bin/jq -e \
  --arg action "$CAMPAIGN_ACTION" \
  --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" '
    .action_type == "host.s22_campaign_start_publication"
    and .approval_path == $action
    and .request_fingerprint == $fingerprint
    and .authoritative == false
    and .approval_required == true
    and .root_operations_performed == false
    and .production_deploy == false
  ' "$CAMPAIGN_APPROVAL_PAYLOAD_RESPONSE" >/dev/null
/usr/bin/jq -e \
  --arg type host.s22_campaign_start_publication \
  --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
  --slurpfile action "$CAMPAIGN_ACTION" '
    .action_type == $type
    and .action_fingerprint == $fingerprint
    and .action_payload == $action[0]
    and .risk_level == "high"
    and (.status == "pending" or .status == "approved")
  ' "$CAMPAIGN_GATE_CREATE" >/dev/null
CAMPAIGN_GATE_ID=$(/usr/bin/jq -er '.id' "$CAMPAIGN_GATE_CREATE")
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- \
  "$CAMPAIGN_APPROVAL_RESPONSE")" = \
  "600 $CAMPAIGN_OPERATOR_UID $CAMPAIGN_OPERATOR_GID 1"

# Once begin may have reached the server, no validation failure may strand a
# safely identified accepted revision. All statuses remain guarded until finish.
set +e
if ! campaign_recover_begin_revision; then
  /usr/bin/printf '%s\n' \
    'same-attempt campaign begin recovery is not yet observable; rerun this exact state directory and attempt while the approved capability remains valid' \
    >&2
  exit 75
fi

# An existing launch fence is reconciliation-only. Never invoke launch-start or
# the privileged vector again for that fence.
CAMPAIGN_NEW_LAUNCH=false
CAMPAIGN_LAUNCH_STATUS=125
if [[ $CAMPAIGN_BEGIN_READY == true \
  && $CAMPAIGN_BEGIN_OBSERVED_TERMINAL != true \
  && ! -e $CAMPAIGN_LAUNCH_START && ! -L $CAMPAIGN_LAUNCH_START ]]
then
  ( set -o noclobber
    run_campaign_execution_tool launch-start \
      --approval "$CAMPAIGN_ACTION" \
      --path "$CAMPAIGN_LAUNCH_START" \
      --approval-attestation "$CAMPAIGN_APPROVAL_ATTESTATION" \
      >"$CAMPAIGN_LAUNCH_PUBLICATION"
  )
  CAMPAIGN_LAUNCH_STATUS=$?
  if [[ $CAMPAIGN_LAUNCH_STATUS == 0 ]]; then
    CAMPAIGN_NEW_LAUNCH=true
  fi
fi

CAMPAIGN_VERIFY_STATUS=1
if [[ $CAMPAIGN_BEGIN_READY == true \
  && -f $CAMPAIGN_LAUNCH_START && ! -L $CAMPAIGN_LAUNCH_START ]]
then
  if campaign_next_observation_path \
    "$CAMPAIGN_VERIFIED_LAUNCH_PREFIX" 1024
  then
    CAMPAIGN_VERIFIED_LAUNCH=$CAMPAIGN_NEXT_OBSERVATION
    ( set -o noclobber
      run_campaign_execution_tool verify-launch-start \
        --approval "$CAMPAIGN_ACTION" \
        --path "$CAMPAIGN_LAUNCH_START" \
        >"$CAMPAIGN_VERIFIED_LAUNCH"
    )
    CAMPAIGN_VERIFY_STATUS=$?
  fi
fi

CAMPAIGN_PRIVILEGED_ARGV=()
CAMPAIGN_RECONCILIATION_ARGV=()
CAMPAIGN_VECTOR_STATUS=1
if [[ $CAMPAIGN_VERIFY_STATUS == 0 ]] \
  && /usr/bin/jq -e \
    --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" \
    --arg launch "$CAMPAIGN_LAUNCH_START" '
      .schema_version ==
        "chorus.s22-campaign-start-publication-execution-launch-start/1"
      and .approval_fingerprint == $fingerprint
      and .authorization.execution_authorized == true
      and .root_launch_may_have_begun == true
      and .repeat_privileged_launch == false
      and .campaign_start_publication == true
      and .broker_invocation == false
      and .service_start == false
      and .production_deploy == false
      and .production_traffic == false
      and .external_network_access == false
    ' "$CAMPAIGN_LAUNCH_START" >/dev/null \
  && /usr/bin/jq -e \
    --arg launch "$CAMPAIGN_LAUNCH_START" '
      .schema_version ==
        "chorus.s22-campaign-start-publication-execution-launch-publication/1"
      and .launch_start_path == $launch
      and .repeat_privileged_launch == false
      and (.privileged_argv | type == "array" and length > 0
        and all(.[]; type == "string" and length > 0))
      and (.reconciliation_argv | type == "array" and length > 0
        and all(.[]; type == "string" and length > 0))
    ' "$CAMPAIGN_VERIFIED_LAUNCH" >/dev/null
then
  CAMPAIGN_PRIVILEGED_VECTOR_STATUS=1
  CAMPAIGN_RECONCILIATION_VECTOR_STATUS=1
  if campaign_next_observation_path \
    "$CAMPAIGN_PRIVILEGED_ARGV_NUL_PREFIX" 1024
  then
    CAMPAIGN_PRIVILEGED_ARGV_NUL=$CAMPAIGN_NEXT_OBSERVATION
    ( set -o noclobber
      /usr/bin/jq -j '.privileged_argv[] | ., "\u0000"' \
        "$CAMPAIGN_VERIFIED_LAUNCH" >"$CAMPAIGN_PRIVILEGED_ARGV_NUL"
    )
    CAMPAIGN_PRIVILEGED_VECTOR_STATUS=$?
  fi
  if campaign_next_observation_path \
    "$CAMPAIGN_RECONCILIATION_ARGV_NUL_PREFIX" 1024
  then
    CAMPAIGN_RECONCILIATION_ARGV_NUL=$CAMPAIGN_NEXT_OBSERVATION
    ( set -o noclobber
      /usr/bin/jq -j '.reconciliation_argv[] | ., "\u0000"' \
        "$CAMPAIGN_VERIFIED_LAUNCH" >"$CAMPAIGN_RECONCILIATION_ARGV_NUL"
    )
    CAMPAIGN_RECONCILIATION_VECTOR_STATUS=$?
  fi
  if [[ $CAMPAIGN_PRIVILEGED_VECTOR_STATUS == 0 \
    && $CAMPAIGN_RECONCILIATION_VECTOR_STATUS == 0 ]]
  then
    mapfile -d '' -t CAMPAIGN_PRIVILEGED_ARGV \
      <"$CAMPAIGN_PRIVILEGED_ARGV_NUL"
    CAMPAIGN_PRIVILEGED_MAP_STATUS=$?
    mapfile -d '' -t CAMPAIGN_RECONCILIATION_ARGV \
      <"$CAMPAIGN_RECONCILIATION_ARGV_NUL"
    CAMPAIGN_RECONCILIATION_MAP_STATUS=$?
    if [[ $CAMPAIGN_PRIVILEGED_MAP_STATUS == 0 \
      && $CAMPAIGN_RECONCILIATION_MAP_STATUS == 0 \
      && ${#CAMPAIGN_PRIVILEGED_ARGV[@]} -gt 0 \
      && ${#CAMPAIGN_RECONCILIATION_ARGV[@]} -gt 0 ]]
    then
      CAMPAIGN_VECTOR_STATUS=0
    fi
  fi
fi

# Sole mutating dispatch: the helper runs it only for a launch fence created by
# this invocation. A pre-existing fence can only reach reconciliation.
campaign_dispatch_new_launch_once

CAMPAIGN_RECONCILIATION_STATUS=1
if [[ $CAMPAIGN_VECTOR_STATUS == 0 ]]; then
  # This wrapper-emitted vector is read-only and may be retried after output loss.
  if campaign_next_observation_path \
    "$CAMPAIGN_RECONCILIATION_RESPONSE_PREFIX" 1024
  then
    CAMPAIGN_RECONCILIATION_RESPONSE=$CAMPAIGN_NEXT_OBSERVATION
    ( set -o noclobber
      "${CAMPAIGN_RECONCILIATION_ARGV[@]}" \
        >"$CAMPAIGN_RECONCILIATION_RESPONSE"
    )
    CAMPAIGN_RECONCILIATION_STATUS=$?
  fi
fi

CAMPAIGN_RECONCILIATION_VERIFIED=false
if [[ $CAMPAIGN_BEGIN_READY == true \
  && $CAMPAIGN_RECONCILIATION_STATUS == 0 ]] \
  && /usr/bin/jq -e \
    --arg fingerprint "$CAMPAIGN_EXPECTED_FINGERPRINT" '
      .schema_version ==
        "chorus.s22-campaign-start-publication-execution-reconciliation/1"
      and .action_type == "host.s22_campaign_start_publication"
      and .state == "completed"
      and .receipt.state == "postcommit-verified"
      and .receipt.approval_fingerprint == $fingerprint
      and .receipt.campaign_start_publication == true
      and .receipt.fixed_authority_publication == true
      and .receipt.public_authority.snapshot.path ==
        .receipt.publication.public_snapshot_path
      and .receipt.public_authority.snapshot_schema_version ==
        "chorus.s22-campaign-public-authority-snapshot/1"
      and .receipt.public_authority.publication_order == [
        "foundation-attestor-policy.json",
        "campaign-trust-policy.json",
        "broker-runtime-policy.json",
        "broker-build-receipt.json",
        "aot-build-receipt.json",
        "campaign-authority-snapshot.json",
        "result.json",
        "receipt.json"
      ]
      and .receipt.public_authority.campaign_start_authority == true
      and .receipt.public_authority.terminal_authority == false
      and .receipt.publication.journal_published_before_inner_mutation == true
      and .receipt.publication.authority_copies_published_before_snapshot == true
      and .receipt.publication.snapshot_published_before_result == true
      and .receipt.publication.result_published_before_receipt == true
      and .receipt.publication.receipt_published_last == true
      and .receipt.publication.repeat_privileged_launch == false
      and .receipt.broker_invocation == false
      and .receipt.service_start == false
      and .receipt.production_deploy == false
      and .receipt.production_traffic == false
      and .receipt.external_network_access == false
      and .repeat_privileged_launch == false
      and .read_only == true
      and .privileged_replay == false
      and .production_deploy == false
    ' "$CAMPAIGN_RECONCILIATION_RESPONSE" >/dev/null
then
  CAMPAIGN_RECONCILIATION_VERIFIED=true
fi

if ! campaign_select_finish_contract; then
  /usr/bin/printf '%s\n' \
    'campaign terminal observation is outside the accepted finish contract' \
    >&2
  exit 77
fi

if ! campaign_finish_until_validated; then
  /usr/bin/printf '%s\n' \
    'campaign finish is not yet durably observable; rerun this exact state directory and attempt without repeating privileged work' \
    >&2
  exit 76
fi
set -e
campaign_validate_finish_response "$CAMPAIGN_FINISH_RESPONSE"
campaign_require_verified_success
CAMPAIGN_AUTHORITY_SNAPSHOT=$(
  /usr/bin/jq -er '.receipt.publication.public_snapshot_path' \
    "$CAMPAIGN_RECONCILIATION_RESPONSE"
)
[[ $CAMPAIGN_AUTHORITY_SNAPSHOT =~ ^/var/lib/chorus/s22-public/m001/campaign-start-executions/[0-9a-f]{64}/campaign-authority-snapshot\.json$ ]]

An exact journal may recover either a wholly staged transaction or all four exact landed destinations; any partial or conflicting fixed set is permanently failed and preserved. Interruption after launch-start is always reconciliation-only. Re-run the verified emitted reconciliation vector, never the privileged vector, and finish the same attempt with the recorded revision.

After successful reconciliation, use its validated receipt to bind the four fixed bytes and the exact CAMPAIGN_AUTHORITY_SNAPSHOT path. That immutable snapshot binds five readable authority documents and is the only authority input accepted by campaign start, resume, and governance transition; those lifecycle steps do not rediscover or reread the private fixed paths. This publication gate authorizes no ambient root command after the emitted vector. Preserve this exact foundation through the final broker transaction. The later 16-file install must exact-reopen these four fixed bytes; it may not silently replace them.

This public snapshot closes only campaign start, resume, and governance transition. The later terminal-authorization verifier still consumes its separately installed private fixed /etc/chorus/s22/m001 authority set. Do not treat this snapshot as terminal authority or widen that separate bridge without a new review and approval.

Run provisional A/B

start directly performs, for each role:

start stack → retain matrix run → retained preflight → finalize dependencies → publish sealed evidence → stop stack

At most one run is retained at a time. Canonical evidence and closure inputs are born read-only (0400); activation markers, the campaign journal, review, and transition receipt are owner-only (0600).

: "${CAMPAIGN_AUTHORITY_SNAPSHOT:?exact path from the verified campaign-start execution receipt}"
set +e
bun run scripts/run-s22-closure-campaign.ts start \
  --campaign "$CAMPAIGN" \
  --image "$CHORUS_IMAGE" \
  --authority-snapshot "$CAMPAIGN_AUTHORITY_SNAPSHOT"
status=$?
set -e
test "$status" -eq 20

Exit 20 is the intentional human governance pause. Inspect the projection with:

set +e
bun run scripts/run-s22-closure-campaign.ts status --campaign "$CAMPAIGN"
status=$?
set -e
test "$status" -eq 20

Require:

jq --exit-status --arg snapshot "$CAMPAIGN_AUTHORITY_SNAPSHOT" '
  .schema_version == "chorus.s22-closure-campaign/3"
  and .status == "awaiting-governance"
  and .authority_snapshot.path == $snapshot
  and .authority_snapshot.publication_directory == ($snapshot | sub("/campaign-authority-snapshot.json$"; ""))
  and .authority_snapshot.mode == "0444"
  and .authority_snapshot.uid == 0
  and .authority_snapshot.gid == 0
  and .authority_snapshot.link_count == 1
  and .authority_snapshot.result.path == (($snapshot | sub("/campaign-authority-snapshot.json$"; "")) + "/result.json")
  and .authority_snapshot.receipt.path == (($snapshot | sub("/campaign-authority-snapshot.json$"; "")) + "/receipt.json")
  and .authority_snapshot.result.sha256 == .authority_snapshot.receipt.sha256
  and .authority_snapshot.result.size_bytes == .authority_snapshot.receipt.size_bytes
  and .authority_snapshot.result.mode == "0444"
  and .authority_snapshot.receipt.mode == "0444"
  and .authority_snapshot.result.uid == 0
  and .authority_snapshot.receipt.uid == 0
  and .authority_snapshot.result.gid == 0
  and .authority_snapshot.receipt.gid == 0
  and .authority_snapshot.result.link_count == 1
  and .authority_snapshot.receipt.link_count == 1
  and ((.authority_snapshot.result.device + ":" + .authority_snapshot.result.inode)
    != (.authority_snapshot.receipt.device + ":" + .authority_snapshot.receipt.inode))
  and .terminal_authority == null
  and .roles["provisional-a"].step == "complete"
  and .roles["provisional-b"].step == "complete"
  and .provisional_closure.activation.mode == "0600"
  and .provisional_closure.input_manifest.mode == "0400"
  and .provisional_closure.receipt.mode == "0400"
  and .provisional_closure.evidence.mode == "0400"
' "$CAMPAIGN/campaign.json" >/dev/null

Independent review

The reviewers must inspect the provisional evidence independently. Review v3 is assembled from an unsigned canonical payload plus detached Ed25519 signatures and conforms to schemas/audit/s22-governance-review.schema.json, mode 0600.

The review must:

• bind .provisional_closure.governance_snapshot as payload.before_governance;
• bind .provisional_closure.activation as payload.provisional_activation;
• bind the exact governance reviewer_policy.policy_id and .nonce;
• list every currently active finding/defect ID once, in governance order;
• list every open risk ID once, in governance order;
• close each implementation/review item;
• close a risk under the main review, or approve it with an explicit 3–512-character approval_ref and a separate risk-specific risk-approver quorum;
• retain orchestrator_production_deployment_command_invoked: false.

The CLI will reject a missing, extra, reordered, duplicated, or differently bound outcome. Free-form reviewer identity strings have no authority and are absent in v3. Verified public-key IDs are recorded in the deterministic transition receipt. Every risk in provisional governance must still be open. Pre-populating closed or approved is rejected; only this signed transition can create either disposition, and every approval requires its own risk-specific quorum.

Use the offline tool in three explicit phases. payload consumes an owner-reviewed request containing review_id, decided_at, both descriptors, the provisioned policy, outcomes, and risk outcomes. sign reads a private key only from the supplied external path when it is owned by the current UID with exact mode 0400 or 0600, then clears the input buffer. assemble consumes the payload and detached signature objects; every output path must be new and is created with exact mode 0600.

bun run scripts/s22-governance-review-tools.ts payload \
  --request /secure/review-request.json \
  --output /secure/review-payload.json

bun run scripts/s22-governance-review-tools.ts sign \
  --payload /secure/review-payload.json \
  --private-key /secure/reviewer-a.pk8.pem \
  --output /secure/reviewer-a.signature.json

# Repeat per signer. For each approved risk, repeat with:
bun run scripts/s22-governance-review-tools.ts sign \
  --payload /secure/review-payload.json \
  --private-key /secure/risk-approver-a.pk8.pem \
  --risk-id RISK-EXAMPLE \
  --output /secure/risk-example-a.signature.json

bun run scripts/s22-governance-review-tools.ts assemble \
  --request /secure/review-assembly.json \
  --output "$REVIEW"

test -f "$REVIEW"
chmod 600 "$REVIEW"
test "$(jq -r .schema_version "$REVIEW")" = chorus.s22-governance-review/3

jq --slurpfile campaign "$CAMPAIGN/campaign.json" --exit-status '
  ($campaign | length) == 1
  and .payload.before_governance == $campaign[0].provisional_closure.governance_snapshot
  and .payload.provisional_activation == $campaign[0].provisional_closure.activation
  and .payload.orchestrator_production_deployment_command_invoked == false
' "$REVIEW" >/dev/null

Publish the governance transition

The transition is deterministic from the sealed provisional governance bytes, the exact provisional closure, and the independent review. Publication is serialized. Concurrent identical writers exact-reopen one receipt; divergent writers cannot leave canonical governance mismatched to the winning receipt. Before replacing governance, the publisher durably links an immutable review-specific intent. A killed writer may only be resumed by that exact review; another review cannot claim the changed state.

bun run scripts/run-s22-closure-campaign.ts transition \
  --campaign "$CAMPAIGN" \
  --review "$REVIEW"

test "$(jq -r .status "$CAMPAIGN/campaign.json")" = transitioned
test "$(jq -r .schema_version "$GOVERNANCE")" = chorus.s22-governance-state/3
test "$(jq -r .phase "$GOVERNANCE")" = final

The canonical receipt is .gsd/milestones/M001/slices/S22/S22-GOVERNANCE-TRANSITION.json. Do not edit the governance file, review, receipt, provisional evidence, or campaign journal.

Run final A/B

set +e
bun run scripts/run-s22-closure-campaign.ts resume --campaign "$CAMPAIGN"
status=$?
set -e
test "$status" -eq 21

Exit 21 is the terminal-verification pause, not a success claim. Require:

jq --exit-status '
  .status == "awaiting-terminal-verification"
  and .terminal_authority == null
  and ([.roles[].step] | all(. == "complete"))
  and .roles["final-b"].provisional_closure == null
  and .pending_terminal_activation == .roles["final-b"].activation
' "$CAMPAIGN/campaign.json" >/dev/null

If a command is interrupted or returns an operational error, inspect status and run resume again. A failure before dependency finalization restores the retained swap. If restoration itself fails, the journal remains in restore-required with the exact run; repair the reported dependency condition and resume so restoration completes before a new attempt starts. If the process dies after the dependency swap but before matrix-summary.json, resume validates the deterministic run’s archived stack, restores its journal to restored, preserves the partial run as forensic material, and starts a fresh attempt/token. A crash while the journal is finalizing or finalized never invokes rollback: finalization is retried idempotently on the exact run and live stack.

A finalized run may only publish while its original stack session is still live and exactly matches the archived provenance. If cleanup stopped that stack, resume abandons the old immutable run and performs a fresh attempt on a new 24-character stack/config/lifecycle identity; it never restarts a new session under the old run. Before stack cleanup, the production adapter fsyncs an owner-only stack-stop-intent.json with status stopping, bound to the archived provenance digest, stack projection, service PID/socket, and SurrealDB container ID. The intent is retained. Only after exact process and artifact verification does it exclusively publish the separate immutable stack-stop-receipt.json (0400) with status stopped. A crash before the campaign journal saves completion can therefore recover the exact stop transaction without repeating a destructive stop or treating absence alone as authority.

Verify the staging marker, then measured authority offline

bun run scripts/run-s22-closure-campaign.ts verify \
  --campaign "$CAMPAIGN" \
  --offline \
  > /tmp/s22-terminal-verification.json

jq --exit-status '
  .schema_version == "chorus.s22-campaign-terminal-staging-projection/1"
  and .status == "staging-verified"
  and .staging_verified == true
  and .authoritative == false
  and .production_deploy == false
  and .orchestrator_production_deployment_command_invoked == false
  and (.transition_id | test("^[0-9a-f]{64}$"))
  and .activation.mode == "0600"
  and .terminal_marker.mode == "0600"
' /tmp/s22-terminal-verification.json >/dev/null

This result proves the staging marker contract only. Its authoritative: false value is mandatory; a marker-only result that claims authority is rejected. The retained marker descriptor must next be consumed by the measured sealed-replay worker and root broker. Accept only a signed broker envelope that binds the exact marker descriptor, measured validator/runtime bytes, executable mappings, brokered output digest, launch-policy nonce, and production_deploy: false, and whose worker and broker signatures both reverify against their provisioned public keys.

Persist the complete .terminal_marker descriptor outside the mutable campaign journal. It is the external anchor for later verification:

MARKER=$(jq -r .terminal_marker.path /tmp/s22-terminal-verification.json)
MARKER_SHA=$(jq -r .terminal_marker.sha256 /tmp/s22-terminal-verification.json)
MARKER_SIZE=$(jq -r .terminal_marker.size_bytes /tmp/s22-terminal-verification.json)

bun run scripts/run-s22-closure-campaign.ts verify-terminal \
  --marker "$MARKER" \
  --sha256 "$MARKER_SHA" \
  --size-bytes "$MARKER_SIZE" \
  --offline \
  > /tmp/s22-terminal-reverification.json

verify-terminal is structurally read-only: it does not initialize the production lifecycle and a missing or mismatched marker creates no directories or files. The marker binds a 0400 terminal receipt and input manifest. That bundle contains the exact 0600 campaign snapshot and governance transition, all four role evidence files, all four retained stop intents, all four immutable stop receipts, all four archived stack provenances, and the complete imported final closure (including its provisional ancestor). Extra or unreferenced manifest entries fail verification.

Verification fails closed unless the final activation has exactly one ancestor and it is the campaign/receipt provisional activation. The verifier consumes that ancestor from the final bundle’s recursively embedded CAS; deleting the old provisional run or changing live source paths does not weaken historical replay.

Both activations must have been replayed by the exact s22-integrated/3 validator contract. The two sealed repeatability receipts must bind the campaign’s exact four role evidence descriptors and deterministic run IDs. Across all four records, run directories, stack sessions, stack roots, provenance descriptors, Surreal container IDs, database namespaces, and password commitments must be distinct.

The shared campaign semantic oracle is used for both the mutable publication path and the marker-only path. It binds the campaign snapshot to both A/B pairs, the exact Matrix B activation descriptors, four distinct disposable identities, the sole provisional ancestor, and the deterministic governance transition. After the marker descriptor is safely retained, later verification does not consult mutable campaign.json or the original run stop files.

Complete the measured broker after final A/B

The pre-campaign foundation and phase-one runtime candidate above are prerequisites, not work deferred until this point. After final A/B, this separate privileged workflow adds the signed terminal intent and measured request, finalizes the 16-file candidate, and—under later gates—installs and invokes it. Nothing in the disposable four-run campaign implicitly authorizes root writes, a setuid bit, broker invocation, customer traffic, or a production deployment. The renderer only creates current-UID, mode-0700 candidate directories containing mode-0400 review files. Every receipt it emits says authoritative: false, root_operations_performed: false, broker_invoked: false, and production_deploy: false.

The obsolete provision-plan v1 and its launch-policy projection are retired. Use only chorus.s22-measured-broker-provision-plan/2. The current path has two phases because the signed trust policy must bind the exact runtime-policy bytes that will be installed.

Construct the measured request and sign terminal intent

The final Matrix B activation and sealed closure now provide the immutable terminal marker, every measured input, and the expected deterministic semantic-result descriptor. Choose the terminal intent ID and epoch once. Build the request first: the builder measures every existing input, derives the candidate set itself, and accepts only the expected future semantic result descriptor.

MEASURED_REQUEST_PLAN=/secure/s22-measured-request-plan.json
MEASURED_REQUEST=/secure/current-terminal-request.txt
: "${INTENT_ID:?reviewed terminal intent ID}"
: "${INTENT_EPOCH:?reviewed positive terminal intent epoch}"
: "${TERMINAL_MARKER_PATH:?canonical terminal marker logical path}"
: "${SEMANTIC_RESULT_PATH:?canonical semantic result path}"
: "${SEMANTIC_RESULT_SHA256:?expected semantic result digest}"
: "${SEMANTIC_RESULT_SIZE:?expected semantic result byte size}"
: "${MEASURED_INPUTS_JSON:?reviewed measured input array file}"
TRUST_SHA256=$(sha256sum "$TRUST_CANDIDATE" | cut -d' ' -f1)

# MEASURED_INPUTS_JSON is a reviewed JSON array. Every member has exactly
# {"source_path":"/absolute/file","path":"logical/path","mode":"0400"};
# exactly one member is the terminal marker with mode "0600".
jq -cn \
  --arg campaign_id "$S22_CAMPAIGN" \
  --arg intent_id "$INTENT_ID" \
  --argjson epoch "$INTENT_EPOCH" \
  --arg trust_sha256 "$TRUST_SHA256" \
  --arg terminal_marker_path "$TERMINAL_MARKER_PATH" \
  --arg semantic_path "$SEMANTIC_RESULT_PATH" \
  --arg semantic_sha256 "$SEMANTIC_RESULT_SHA256" \
  --argjson semantic_size "$SEMANTIC_RESULT_SIZE" \
  --slurpfile inputs "$MEASURED_INPUTS_JSON" '
  {
    "campaign_id":$campaign_id,
    "campaign_intent":{
      "intent_id":$intent_id,
      "epoch":$epoch,
      "trust_policy_sha256":$trust_sha256
    },
    "terminal_marker_path":$terminal_marker_path,
    "semantic_result":{
      "path":$semantic_path,
      "sha256":$semantic_sha256,
      "size_bytes":$semantic_size,
      "mode":"0400"
    },
    "inputs":$inputs[0]
  }' >"$MEASURED_REQUEST_PLAN"
chmod 0600 "$MEASURED_REQUEST_PLAN"

bun run scripts/create-s22-measured-terminal-request.ts \
  --plan "$MEASURED_REQUEST_PLAN" \
  --output "$MEASURED_REQUEST"
test "$(stat -c '%u %a' "$MEASURED_REQUEST")" = "$(id -u) 400"

Prepare the exact terminal-intent request with the measured request digest/size, the same marker, trust/build/broker tuple, validity window, and both production flags false. Then create, independently sign in both domains, assemble, and verify it:

INTENT_REQUEST=/secure/s22-terminal-intent-request.json
INTENT_PAYLOAD=/secure/s22-terminal-intent-payload.json
INTENT_ASSEMBLY=/secure/s22-terminal-intent-assembly.json
INTENT_CANDIDATE=/secure/current-terminal-intent.json
INTENT_NOW=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)

bun run scripts/s22-root-authority-tools.ts intent-payload \
  --request "$INTENT_REQUEST" \
  --foundation-attestor-policy "$S22_FOUNDATION_ATTESTOR_POLICY" \
  --trust "$TRUST_CANDIDATE" \
  --now "$INTENT_NOW" \
  --output "$INTENT_PAYLOAD"

bun run scripts/s22-root-authority-tools.ts intent-sign \
  --payload "$INTENT_PAYLOAD" \
  --foundation-attestor-policy "$S22_FOUNDATION_ATTESTOR_POLICY" \
  --trust "$TRUST_CANDIDATE" \
  --now "$INTENT_NOW" \
  --private-key /secure/reviewer-a.ed25519.pem \
  --domain review \
  --output /secure/intent-review-a.signature.json

bun run scripts/s22-root-authority-tools.ts intent-sign \
  --payload "$INTENT_PAYLOAD" \
  --foundation-attestor-policy "$S22_FOUNDATION_ATTESTOR_POLICY" \
  --trust "$TRUST_CANDIDATE" \
  --now "$INTENT_NOW" \
  --private-key /secure/reviewer-a.ed25519.pem \
  --domain risk \
  --output /secure/intent-risk-a.signature.json

# Repeat both domain-separated signatures for every independent signer. The
# assembly request has exactly: payload, review_signatures, risk_signatures.
bun run scripts/s22-root-authority-tools.ts intent-assemble \
  --request "$INTENT_ASSEMBLY" \
  --foundation-attestor-policy "$S22_FOUNDATION_ATTESTOR_POLICY" \
  --trust "$TRUST_CANDIDATE" \
  --now "$INTENT_NOW" \
  --output "$INTENT_CANDIDATE"

bun run scripts/s22-root-authority-tools.ts intent-verify \
  --authority "$INTENT_CANDIDATE" \
  --foundation-attestor-policy "$S22_FOUNDATION_ATTESTOR_POLICY" \
  --trust "$TRUST_CANDIDATE" \
  --now "$INTENT_NOW"

The terminal intent is a new canonical mode-0400 file, and the measured request is a new canonical mode-0400 file. Payloads, detached signatures, assembly requests, and private keys remain owner-only intermediates; none may overwrite prior bytes.

Refresh freshness and replay phase one

The four evidence runs can outlive the plan’s five-minute replay window. Immediately before finalization, refresh only verification_time into a new immutable plan and rerender phase one from the remeasured foundation. The runtime-policy digest signed by campaign trust must remain byte-identical; any difference abandons this finalization and requires newly reviewed campaign authority. Neither output may overwrite an earlier plan or candidate.

Each candidate file is first written and read back as an unnamed same-filesystem inode with mode 0400. The writable descriptor is then closed, an independent read-only descriptor acquires a kernel read lease that excludes writers, and only that leased inode is linked into the candidate tree without replacement. All file leases and pre-publication parent watches remain live through exact tree enumeration and the final byte replay. A lease break, changed entry, or changed inode aborts the candidate, so the final checks share one write-excluded linearization point. The resulting directory is still non-authoritative and must be reverified against its approval fingerprint before installation.

FRESH_PLAN=/secure/s22-measured-provision-plan-final.json
test ! -e "$FRESH_PLAN"

REFRESH_RESULT=$(
  bun scripts/generate-s22-measured-provision.ts refresh-plan \
    --plan "$PLAN" \
    --output "$FRESH_PLAN"
)
printf '%s\n' "$REFRESH_RESULT" | jq --exit-status \
  'select(.authoritative == false and .production_deploy == false
    and .refreshed_plan.mode == "0400"
    and .runtime_policy.unchanged == true)' >/dev/null
test "$(stat -c '%u %a' "$FRESH_PLAN")" = "$(id -u) 400"

FRESH_RUNTIME_RESULT=$(
  bun scripts/generate-s22-measured-provision.ts render-runtime \
    --plan "$FRESH_PLAN" \
    --output-parent "$CANDIDATE_PARENT"
)
FRESH_RUNTIME_CANDIDATE=$(printf '%s\n' "$FRESH_RUNTIME_RESULT" | jq -er \
  'select(.authoritative == false and .approval_required == true
    and .root_operations_performed == false and .broker_invoked == false)
   | .candidate_directory')
cmp "$RUNTIME_CANDIDATE/broker-runtime-policy.json" \
  "$FRESH_RUNTIME_CANDIDATE/broker-runtime-policy.json"

Phase two: finalize and review the install candidate

Finalization remeasures every static input, requires the unchanged phase-one policy, uses the real current time for signature validity, checks all cross-bindings, and renders the native 38-field config in declaration order.

FINAL_RESULT=$(
  bun scripts/generate-s22-measured-provision.ts finalize \
    --plan "$FRESH_PLAN" \
    --runtime-candidate "$FRESH_RUNTIME_CANDIDATE" \
    --output-parent "$CANDIDATE_PARENT"
)
FINAL_CANDIDATE=$(printf '%s\n' "$FINAL_RESULT" | jq -er \
  'select(.authoritative == false and .approval_required == true
    and .root_operations_performed == false and .broker_invoked == false
    and .private_key_material_included == false)
   | .candidate_directory')

jq . "$FINAL_CANDIDATE/provision-receipt.json"
jq . "$FINAL_CANDIDATE/install-manifest.json"
test ! -e "$FINAL_CANDIDATE/payload/broker-signing-seed.bin"
INSTALL_MANIFEST_SHA256=$(sha256sum "$FINAL_CANDIDATE/install-manifest.json" \
  | cut -d' ' -f1)
PROVISION_PLAN_SHA256=$(sha256sum "$FINAL_CANDIDATE/provision-plan.json" \
  | cut -d' ' -f1)
jq --arg plan_sha256 "$PROVISION_PLAN_SHA256" \
  --argjson plan_size "$(stat -c %s "$FINAL_CANDIDATE/provision-plan.json")" \
  --exit-status '
    .provision_plan == {
      candidate_path: "provision-plan.json",
      sha256: $plan_sha256,
      size_bytes: $plan_size
    }
    and (.files | length) == 16
  ' "$FINAL_CANDIDATE/install-manifest.json" >/dev/null
printf 'approval fingerprint: install-manifest sha256:%s\n' \
  "$INSTALL_MANIFEST_SHA256"

Open a fresh root-install approval gate bound to that manifest digest, the candidate directory identity, the manifest’s exact provision-plan commitment, the already-derived public key, the dedicated target UID/GID, and the allowed real caller UID. The manifest digest is the approval fingerprint: changing or substituting the plan, reordering a copy entry, or changing any source, destination, mode, digest, or size requires a new manifest and a new approval. A gate for key creation is not an install gate, and an install gate is not an invocation gate.

Use this exact approval scope, replacing every angle-bracketed value with the reviewed literal:

Approve one root installation from candidate directory <canonical-directory> whose install-manifest.json SHA-256 is <64-lowercase-hex>. That manifest must commit provision-plan.json as SHA-256 <64-lowercase-hex> and size <bytes>, the broker public key <64-lowercase-hex>, target UID/GID <uid>:<gid>, and allowed real caller UID <uid>. Copy exactly its ordered 16 mappings, do not read or mutate the signing seed, keep the launcher at 0755 until every other file is durable and verified, and apply 04755 as the final write. This approval does not authorize broker invocation, customer traffic, or production deployment. Any mismatch denies the operation and requires a new gate.

Approved root installation and verification

The install manifest is the exact ordered copy list. Its provision_plan commitment must match the candidate’s canonical provision-plan.json byte-for-byte. The parser rejects an extra, missing, reordered, duplicated, or substituted entry even when an attacker supplies a self-consistent replacement digest. For the canonical M001 plan, the 16 mappings are:

#	Candidate source	Root destination	Installed mode
1	payload/launcher	/usr/local/libexec/chorus/s22/m001/launcher	0755 while staging; 04755 only at final activation
2	payload/preload.so	/usr/local/libexec/chorus/s22/m001/preload.so	0555
3	payload/broker-build-host-trust-anchor.json	/etc/chorus/s22/m001/broker-build-host-trust-anchor.json	0400
4	payload/broker-build-receipt.json	/etc/chorus/s22/m001/broker-build-receipt.json	0400
5	payload/aot-build-receipt.json	/etc/chorus/s22/m001/aot-build-receipt.json	0400
6	payload/measured-aot-policy.json	/etc/chorus/s22/m001/measured-launch-policy.json	0444
7	payload/measured-aot-policy.sha256	/etc/chorus/s22/m001/measured-launch-policy.sha256	0400
8	payload/source-manifest.txt	/etc/chorus/s22/m001/measured-source-manifest.txt	0400
9	payload/runtime-objects-manifest.txt	/etc/chorus/s22/m001/runtime-objects-manifest.txt	0400
10	payload/arguments-manifest.txt	/etc/chorus/s22/m001/arguments-manifest.txt	0400
11	payload/environment-manifest.txt	/etc/chorus/s22/m001/environment-manifest.txt	0400
12	payload/campaign-trust-policy.json	/etc/chorus/s22/m001/campaign-trust-policy.json	0400
13	payload/current-terminal-intent.json	/etc/chorus/s22/m001/current-terminal-intent.json	0400
14	payload/current-terminal-request.txt	/etc/chorus/s22/m001/current-terminal-request.txt	0400
15	payload/broker-runtime-policy.json	/etc/chorus/s22/m001/broker-runtime-policy.json	0400
16	payload/measured-launch-config.txt	/etc/chorus/s22/m001/measured-launch-config.txt	0400

The fixed foundation-attestor-policy.json is deliberately not a seventeenth mapping. The clean-destination transition must already have published it root:root mode 0400. The runtime policy and install manifest bind its exact fixed path, SHA-256, byte length, and mode as a precondition; installation fails rather than replacing or rewriting it.

The plan may choose different names only for its six plan-controlled policy paths, all under /etc/chorus/s22/m001; the approved manifest must then contain those exact paths in the same positions. Directories /etc/chorus/s22/m001 and /var/lib/chorus/s22/m001 are root-owned mode 0700; /usr/local/libexec/chorus/s22/m001 is root-owned mode 0755. Every installed file is root-owned, single-linked, nonsymlinked, and exact-sized. The pre-existing seed remains root-owned, mode 0400, link count one, and exactly 32 bytes. Bun, libc, loader, and every source-tree file must match the exact rooted digests and modes in the runtime/source manifests.

Before the approved installation starts, prove all of these host preconditions:

• the approval names the exact lowercase SHA-256 of install-manifest.json, and that manifest commits the exact candidate provision-plan.json;
• the operation runs in the initial full host user namespace (uid_map and gid_map both cover 0 0 4294967295), not a remapped container namespace;
• the longest mount covering the launcher path, including / when it is the only match, permits setuid execution and does not carry nosuid;
• /etc/ld.so.preload is absent or is one empty, root-owned, single-linked, non-world-writable regular file;
• the target UID is dedicated and quiescent, differs from the allowed real caller UID, and no process exposes it in any credential slot;
• the signing seed already exists with the exact metadata above, its derived public key is the key signed by campaign authority, and its content is never copied into staging;
• the fixed foundation-attestor policy already exists root-owned, mode 0400, link count one, and matches the exact runtime-policy/install-manifest commitment;
• every runtime/source path in the approved plan exists on this host with the measured identity, and all destination ancestors are root-owned, nonsymlinked, and not writable by group or others; and
• a complete root-only rollback snapshot and inventory of every pre-existing destination has been durably written before the first live path changes.

There is deliberately no root install subcommand. After approval, the root operator must first copy the approved manifest and payload into a new root-owned mode-0700 staging directory beneath root-owned, nonsymlinked ancestors that are not writable by group or others, recheck every SHA-256 and size there, and install only from that pinned staging copy. The staging copy must include the approved manifest, its committed provision plan, and all 16 payload sources. If replacing an older broker, clear the old launcher’s setuid bit before changing any policy file. Install all policy files and the preload, install the launcher initially as 0755, verify the full list, sync every file and parent directory, and set 04755 only after the complete document set is durable. Setting the launcher setuid bit is the last and separate activation write. Never copy, replace, chmod, or otherwise mutate the seed during this step.

Installation is one signed execution action, host.s22_measured_broker_install. Its action payload is the exact canonical JSON written by approval-payload; the gate fingerprint is the result of approval-fingerprint, not a hand-built summary. Keep the approved response, accepted attempt ID and revision, signed begin attestation, durable launch-start record, launch publication, root result, reconciliation result, and execution-finish response together. Run the marked custody prologue in a fresh Bash process on the first attempt and after every reboot, shell loss, or operator handoff. The exact same canonical state parent and state directory are retained; an existing launch-start makes the install reconciliation-only.

# BEGIN S22 INSTALL REBOOT RESUME CUSTODY
set -Eeuo pipefail
shopt -s inherit_errexit
umask 077
export LANG=C LC_ALL=C TZ=UTC

: "${ROOT_STAGING_CANDIDATE:?root-owned mode-0700 pinned candidate copy}"
: "${S22_PINNED_BUN:?absolute pinned Bun path}"
: "${S22_PINNED_BUN_SHA256:?reviewed pinned Bun digest}"
: "${S22_INSTALL_ACTION_TOOL:?absolute pinned install action-tool path}"
: "${S22_INSTALL_EXECUTOR:?absolute pinned root executor path}"
: "${S22_INSTALL_VERIFIER:?absolute pinned installed-state verifier path}"
: "${S22_APPROVAL_BEGIN_VERIFIER:?absolute pinned begin verifier path}"
: "${S22_APPROVAL_BEGIN_KEYS:?one or two comma-separated pinned public-key paths}"
: "${S22_INSTALL_APPROVAL_SCHEMA:?absolute pinned approval schema path}"
: "${S22_INSTALL_RECEIPT_SCHEMA:?absolute pinned receipt schema path}"
: "${S22_INITIAL_HOST_PROBE_BUILD_RECEIPT:?absolute pinned probe receipt path}"
: "${S22_INSTALL_STATE_PARENT:?canonical owner-only mode-0700 state parent}"
: "${S22_INSTALL_STATE:?new or retained private install state directory}"
: "${S22_CHORUS_CLI_SOURCE_ROOT:?reviewed absolute root-owned pinned CLI source closure}"
: "${S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256:?reviewed CLI source-closure digest}"
: "${S22_CHORUS_CLI_ENTRYPOINT_SHA256:?reviewed CLI entrypoint digest}"
: "${S22_CHORUS_CLI_HOME:?canonical owner-only reviewed CLI profile home}"
: "${S22_CHORUS_CLI_CONFIG_SHA256:?reviewed owner-only CLI profile digest}"
: "${APPROVER_IDENTITY:?identity allowed to approve this one installation}"

INSTALL_OPERATOR_UID=$(/usr/bin/id -u)
INSTALL_OPERATOR_GID=$(/usr/bin/id -g)
test "$INSTALL_OPERATOR_UID" -ne 0

install_assert_ancestor_custody() {
  local custody_path=$1
  local custody_fact custody_resolved_fact
  local custody_kind custody_mode custody_uid custody_gid custody_nlink
  while :; do
    [[ $custody_path == /* ]]
    test ! -L "$custody_path"
    test "$(/usr/bin/realpath -e -- "$custody_path")" = "$custody_path"
    custody_fact=$(/usr/bin/stat -c '%F %a %u %g %h' -- "$custody_path")
    custody_resolved_fact=$(
      /usr/bin/stat -Lc '%F %a %u %g %h' -- "$custody_path"
    )
    test "$custody_fact" = "$custody_resolved_fact"
    read -r custody_kind custody_mode custody_uid custody_gid custody_nlink \
      <<<"$custody_fact"
    test "$custody_kind" = directory
    [[ $custody_uid == 0 || $custody_uid == "$INSTALL_OPERATOR_UID" ]]
    if [[ $custody_uid == 0 ]]; then
      test "$custody_gid" = 0
    else
      test "$custody_gid" = "$INSTALL_OPERATOR_GID"
    fi
    (( (8#$custody_mode & 8#022) == 0 ))
    test "$custody_nlink" -ge 2
    [[ $custody_path == / ]] && break
    custody_path=$(/usr/bin/dirname -- "$custody_path")
  done
}

install_assert_owner_directory() {
  local custody_path=$1
  test ! -L "$custody_path"
  test "$(/usr/bin/realpath -e -- "$custody_path")" = "$custody_path"
  test "$(/usr/bin/stat -c '%F %a %u %g' -- "$custody_path")" = \
    "directory 700 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID"
  test "$(/usr/bin/stat -Lc '%a %u %g' -- "$custody_path")" = \
    "700 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID"
  test "$(/usr/bin/stat -c '%h' -- "$custody_path")" -ge 2
}

install_assert_new_capture_path() {
  local capture_path=$1
  [[ $capture_path == "$S22_INSTALL_STATE/"* ]]
  test "$(/usr/bin/dirname -- "$capture_path")" = "$S22_INSTALL_STATE"
  test ! -e "$capture_path" -a ! -L "$capture_path"
}

install_assert_capture_file() {
  local capture_path=$1
  [[ $capture_path == "$S22_INSTALL_STATE/"* ]]
  test "$(/usr/bin/dirname -- "$capture_path")" = "$S22_INSTALL_STATE"
  test -f "$capture_path" -a ! -L "$capture_path"
  test "$(/usr/bin/realpath -e -- "$capture_path")" = "$capture_path"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- "$capture_path")" = \
    "regular file 600 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$capture_path")" = \
    "regular file 600 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID 1"
}

install_require_retained_capture() {
  local capture_path=$1
  install_assert_capture_file "$capture_path"
  test -s "$capture_path"
}

install_capture_stdout() {
  local capture_path=$1
  shift
  local capture_status=0
  install_assert_new_capture_path "$capture_path"
  ( set -o noclobber
    "$@" >"$capture_path"
  ) || capture_status=$?
  install_assert_capture_file "$capture_path"
  return "$capture_status"
}

install_select_reusable_capture() {
  local capture_variable=$1
  local -n capture_reference=$capture_variable
  local capture_base=$capture_reference
  local capture_candidate=$capture_base
  local capture_selected=
  local capture_index=0
  while [[ -e $capture_candidate || -L $capture_candidate ]]; do
    install_assert_capture_file "$capture_candidate"
    if [[ -s $capture_candidate ]]; then
      capture_selected=$capture_candidate
    fi
    capture_index=$((capture_index + 1))
    printf -v capture_candidate '%s.retry-%06d' \
      "$capture_base" "$capture_index"
  done
  printf -v "${capture_variable}_NEXT" '%s' "$capture_candidate"
  if [[ -n $capture_selected ]]; then
    capture_reference=$capture_selected
    return 0
  fi
  capture_reference=$capture_candidate
  return 1
}

install_load_exact_reconciliation_argv() {
  local capture_path=$1
  local expected_sha256=$2
  local expected_count=$3
  local observed_sha256
  local -a observed_argv=()
  if ! observed_sha256=$(
    /usr/bin/sha256sum -- "$capture_path" | /usr/bin/cut -d' ' -f1
  ); then
    return 1
  fi
  [[ $observed_sha256 == "$expected_sha256" ]] || return 1
  mapfile -d '' -t observed_argv <"$capture_path" || return 1
  [[ ${#observed_argv[@]} -eq $expected_count ]] || return 1
  INSTALL_RECONCILIATION_ARGV=("${observed_argv[@]}")
}

install_finish_state_from_capture() {
  local capture_path=$1
  local gate_id=$2
  local attempt_id=$3
  local fingerprint=$4
  local revision=$5
  /usr/bin/jq --exit-status --raw-output \
    --arg gate "$gate_id" \
    --arg attempt "$attempt_id" \
    --arg fingerprint "$fingerprint" \
    --arg revision "$revision" '
      select(
        (."status" == "finished" or ."status" == "idempotent")
        and ."execution_authorized" == false
        and ."attempt"."gate_id" == $gate
        and ."attempt"."attempt_id" == $attempt
        and ."attempt"."request_fingerprint" == $fingerprint
        and (
          .attempt.state == "succeeded"
          or .attempt.state == "failed"
          or .attempt.state == "abandoned"
        )
        and (."attempt"."completed_at" | type == "string" and length > 0)
        and (."attempt"."revision" | type == "number" and floor == .)
        and ."attempt"."revision" == (($revision | tonumber) + 1)
        and (
          if .attempt.state == "succeeded"
          then (."attempt"."last_error" // null) == null
          else (
            ."attempt"."last_error" | type == "string"
            and length >= 1 and length <= 128
          )
          end
        )
      )
      | .attempt.state
    ' "$capture_path"
}

install_assert_root_ancestors() {
  local source_path=$1
  local source_fact source_kind source_mode source_uid source_gid source_nlink
  while :; do
    test ! -L "$source_path"
    test "$(/usr/bin/realpath -e -- "$source_path")" = "$source_path"
    source_fact=$(/usr/bin/stat -c '%F %a %u %g %h' -- "$source_path")
    test "$source_fact" = \
      "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$source_path")"
    read -r source_kind source_mode source_uid source_gid source_nlink \
      <<<"$source_fact"
    test "$source_kind" = directory
    test "$source_uid $source_gid" = "0 0"
    (( (8#$source_mode & 8#022) == 0 ))
    test "$source_nlink" -ge 2
    [[ $source_path == / ]] && break
    source_path=$(/usr/bin/dirname -- "$source_path")
  done
}

test "$(/usr/bin/dirname -- "$S22_INSTALL_STATE")" = \
  "$S22_INSTALL_STATE_PARENT"
install_assert_ancestor_custody "$S22_INSTALL_STATE_PARENT"
install_assert_owner_directory "$S22_INSTALL_STATE_PARENT"
INSTALL_STATE_RETAINED=false
INSTALL_RECOVERY_MODE=false
INSTALL_PREFENCE_MODE=false
if [[ -e $S22_INSTALL_STATE && ! -L $S22_INSTALL_STATE ]]; then
  INSTALL_STATE_RETAINED=true
else
  test ! -e "$S22_INSTALL_STATE" -a ! -L "$S22_INSTALL_STATE"
  /usr/bin/mkdir -m 0700 -- "$S22_INSTALL_STATE"
fi
install_assert_ancestor_custody "$S22_INSTALL_STATE"
install_assert_owner_directory "$S22_INSTALL_STATE"
if [[ $INSTALL_STATE_RETAINED == true ]]; then
  if [[ -s $S22_INSTALL_STATE/launch-start.json ]]; then
    install_require_retained_capture "$S22_INSTALL_STATE/launch-start.json"
    INSTALL_RECOVERY_MODE=true
  else
    if [[ -e $S22_INSTALL_STATE/launch-start.json \
      || -L $S22_INSTALL_STATE/launch-start.json ]]
    then
      install_assert_capture_file "$S22_INSTALL_STATE/launch-start.json"
    fi
    INSTALL_PREFENCE_MODE=true
  fi
fi

S22_INSTALL_CHORUS_CLI_ENTRYPOINT=\
"$S22_CHORUS_CLI_SOURCE_ROOT/packages/cli/src/index.ts"
install_assert_root_ancestors "$(/usr/bin/dirname -- "$S22_PINNED_BUN")"
test "$(/usr/bin/realpath -e -- "$S22_PINNED_BUN")" = "$S22_PINNED_BUN"
test -f "$S22_PINNED_BUN" -a ! -L "$S22_PINNED_BUN"
S22_INSTALL_BUN_FACT=$(
  /usr/bin/stat -Lc '%a %u %g %h' -- "$S22_PINNED_BUN"
)
[[ $S22_INSTALL_BUN_FACT == "555 0 0 1" \
  || $S22_INSTALL_BUN_FACT == "755 0 0 1" ]]
test "$(/usr/bin/sha256sum -- "$S22_PINNED_BUN" | /usr/bin/cut -d' ' -f1)" = \
  "$S22_PINNED_BUN_SHA256"
test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_SOURCE_ROOT")" = \
  "$S22_CHORUS_CLI_SOURCE_ROOT"
test -d "$S22_CHORUS_CLI_SOURCE_ROOT" -a ! -L "$S22_CHORUS_CLI_SOURCE_ROOT"
test "$(/usr/bin/stat -Lc '%a %u %g' -- "$S22_CHORUS_CLI_SOURCE_ROOT")" = \
  "555 0 0"
S22_INSTALL_CLI_SOURCE_ANCESTOR=$S22_CHORUS_CLI_SOURCE_ROOT
while :; do
  test ! -L "$S22_INSTALL_CLI_SOURCE_ANCESTOR"
  test "$(/usr/bin/realpath -e -- "$S22_INSTALL_CLI_SOURCE_ANCESTOR")" = \
    "$S22_INSTALL_CLI_SOURCE_ANCESTOR"
  S22_INSTALL_CLI_ANCESTOR_FACT=$(
    /usr/bin/stat -c '%F %a %u %g %h' -- \
      "$S22_INSTALL_CLI_SOURCE_ANCESTOR"
  )
  test "$S22_INSTALL_CLI_ANCESTOR_FACT" = "$(
    /usr/bin/stat -Lc '%F %a %u %g %h' -- \
      "$S22_INSTALL_CLI_SOURCE_ANCESTOR"
  )"
  read -r S22_INSTALL_CLI_ANCESTOR_KIND S22_INSTALL_CLI_ANCESTOR_MODE \
    S22_INSTALL_CLI_ANCESTOR_UID S22_INSTALL_CLI_ANCESTOR_GID \
    S22_INSTALL_CLI_ANCESTOR_NLINK <<<"$S22_INSTALL_CLI_ANCESTOR_FACT"
  test "$S22_INSTALL_CLI_ANCESTOR_KIND" = directory
  test "$S22_INSTALL_CLI_ANCESTOR_UID $S22_INSTALL_CLI_ANCESTOR_GID" = "0 0"
  (( (8#$S22_INSTALL_CLI_ANCESTOR_MODE & 8#022) == 0 ))
  test "$S22_INSTALL_CLI_ANCESTOR_NLINK" -ge 2
  [[ $S22_INSTALL_CLI_SOURCE_ANCESTOR == / ]] && break
  S22_INSTALL_CLI_SOURCE_ANCESTOR=$(
    /usr/bin/dirname -- "$S22_INSTALL_CLI_SOURCE_ANCESTOR"
  )
done

install_cli_source_closure_stream() {
  local source_path source_relative source_fact
  local source_mode source_uid source_gid source_nlink source_sha256
  while IFS= read -r -d '' source_path; do
    test ! -L "$source_path"
    test "$(/usr/bin/realpath -e -- "$source_path")" = "$source_path"
    source_fact=$(/usr/bin/stat -c '%a %u %g %h' -- "$source_path")
    test "$source_fact" = \
      "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$source_path")"
    read -r source_mode source_uid source_gid source_nlink <<<"$source_fact"
    test "$source_uid $source_gid" = "0 0"
    (( (8#$source_mode & 8#022) == 0 ))
    source_relative=${source_path#"$S22_CHORUS_CLI_SOURCE_ROOT"/}
    test "$source_relative" != "$source_path"
    if [[ -d $source_path ]]; then
      test "$source_nlink" -ge 2
      /usr/bin/printf 'directory\0%s\0%s\0' \
        "$source_relative" "$source_fact"
    elif [[ -f $source_path ]]; then
      test "$source_nlink" = 1
      source_sha256=$(
        /usr/bin/sha256sum -- "$source_path" | /usr/bin/cut -d' ' -f1
      )
      /usr/bin/printf 'file\0%s\0%s\0%s\0' \
        "$source_relative" "$source_fact" "$source_sha256"
    else
      return 1
    fi
  done < <(
    /usr/bin/find -P "$S22_CHORUS_CLI_SOURCE_ROOT" -mindepth 1 -print0 \
      | LC_ALL=C /usr/bin/sort -z
  )
}

S22_INSTALL_CLI_SOURCE_CLOSURE_SHA256=$(
  install_cli_source_closure_stream | /usr/bin/sha256sum \
    | /usr/bin/cut -d' ' -f1
)
test "$S22_INSTALL_CLI_SOURCE_CLOSURE_SHA256" = \
  "$S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256"
test "$S22_INSTALL_ACTION_TOOL" = \
  "$S22_CHORUS_CLI_SOURCE_ROOT/scripts/s22-measured-broker-install.ts"
test "$(/usr/bin/realpath -e -- "$S22_INSTALL_ACTION_TOOL")" = \
  "$S22_INSTALL_ACTION_TOOL"
test -f "$S22_INSTALL_ACTION_TOOL" -a ! -L "$S22_INSTALL_ACTION_TOOL"
test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
  "$S22_INSTALL_ACTION_TOOL")" = "regular file 444 0 0 1"
test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
  "$S22_INSTALL_ACTION_TOOL")" = "regular file 444 0 0 1"
test "$(/usr/bin/realpath -e -- "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT")" = \
  "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT"
test -f "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT" \
  -a ! -L "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT"
test "$(/usr/bin/stat -Lc '%a %u %g %h' -- \
  "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT")" = "444 0 0 1"
test "$(/usr/bin/sha256sum -- \
  "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT" | /usr/bin/cut -d' ' -f1)" = \
  "$S22_CHORUS_CLI_ENTRYPOINT_SHA256"
install_assert_ancestor_custody "$S22_CHORUS_CLI_HOME"
install_assert_owner_directory "$S22_CHORUS_CLI_HOME"
install_assert_owner_directory "$S22_CHORUS_CLI_HOME/.chorus"
S22_INSTALL_CHORUS_CLI_CONFIG="$S22_CHORUS_CLI_HOME/.chorus/config.yaml"
install_assert_cli_config() {
  test "$(/usr/bin/realpath -e -- "$S22_INSTALL_CHORUS_CLI_CONFIG")" = \
    "$S22_INSTALL_CHORUS_CLI_CONFIG"
  test -f "$S22_INSTALL_CHORUS_CLI_CONFIG" \
    -a ! -L "$S22_INSTALL_CHORUS_CLI_CONFIG"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_INSTALL_CHORUS_CLI_CONFIG")" = \
    "regular file 600 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_INSTALL_CHORUS_CLI_CONFIG")" = \
    "regular file 600 $INSTALL_OPERATOR_UID $INSTALL_OPERATOR_GID 1"
  test "$(/usr/bin/sha256sum -- \
    "$S22_INSTALL_CHORUS_CLI_CONFIG" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_CHORUS_CLI_CONFIG_SHA256"
}

install_assert_toolchain() {
  local observed_bun_fact observed_source_closure_sha256
  install_assert_root_ancestors "$(/usr/bin/dirname -- "$S22_PINNED_BUN")"
  test "$(/usr/bin/realpath -e -- "$S22_PINNED_BUN")" = "$S22_PINNED_BUN"
  test -f "$S22_PINNED_BUN" -a ! -L "$S22_PINNED_BUN"
  observed_bun_fact=$(
    /usr/bin/stat -c '%F %a %u %g %h' -- "$S22_PINNED_BUN"
  )
  test "$observed_bun_fact" = \
    "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$S22_PINNED_BUN")"
  [[ $observed_bun_fact == "regular file 555 0 0 1" \
    || $observed_bun_fact == "regular file 755 0 0 1" ]]
  test "$(/usr/bin/sha256sum -- \
    "$S22_PINNED_BUN" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_PINNED_BUN_SHA256"

  test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_SOURCE_ROOT")" = \
    "$S22_CHORUS_CLI_SOURCE_ROOT"
  test "$(/usr/bin/stat -c '%F %a %u %g' -- \
    "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
  test "$(/usr/bin/stat -Lc '%F %a %u %g' -- \
    "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
  install_assert_root_ancestors "$S22_CHORUS_CLI_SOURCE_ROOT"
  observed_source_closure_sha256=$(
    install_cli_source_closure_stream | /usr/bin/sha256sum \
      | /usr/bin/cut -d' ' -f1
  )
  test "$observed_source_closure_sha256" = \
    "$S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256"

  test "$S22_INSTALL_ACTION_TOOL" = \
    "$S22_CHORUS_CLI_SOURCE_ROOT/scripts/s22-measured-broker-install.ts"
  test "$(/usr/bin/realpath -e -- "$S22_INSTALL_ACTION_TOOL")" = \
    "$S22_INSTALL_ACTION_TOOL"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_INSTALL_ACTION_TOOL")" = "regular file 444 0 0 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_INSTALL_ACTION_TOOL")" = "regular file 444 0 0 1"
  test "$(/usr/bin/realpath -e -- "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT")" = \
    "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT")" = \
    "regular file 444 0 0 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT")" = \
    "regular file 444 0 0 1"
  test "$(/usr/bin/sha256sum -- \
    "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_CHORUS_CLI_ENTRYPOINT_SHA256"

  install_assert_ancestor_custody "$S22_CHORUS_CLI_HOME"
  install_assert_owner_directory "$S22_CHORUS_CLI_HOME"
  install_assert_owner_directory "$S22_CHORUS_CLI_HOME/.chorus"
  install_assert_cli_config
  # Bun's documented default config is $cwd/bunfig.toml. Every wrapper uses
  # cwd=/, so every individual call must reject an ambient root config.
  test ! -e /bunfig.toml -a ! -L /bunfig.toml
}
install_assert_toolchain

run_s22_install_chorus_cli() (
  install_assert_toolchain
  cd /
  /usr/bin/env -i \
    PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    HOME="$S22_CHORUS_CLI_HOME" \
    "$S22_PINNED_BUN" --no-env-file run \
    "$S22_INSTALL_CHORUS_CLI_ENTRYPOINT" "$@"
)

run_s22_install_action_tool() (
  install_assert_toolchain
  cd /
  /usr/bin/env -i \
    PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    HOME="$S22_CHORUS_CLI_HOME" \
    "$S22_PINNED_BUN" --no-env-file run \
    "$S22_INSTALL_ACTION_TOOL" "$@"
)

install_verify_prefence_attestation() (
  local action_type=$1
  local approval_path=$2
  local attestation_path=$3
  cd /
  /usr/bin/env -i PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    S22_PREFENCE_ACTION_TYPE="$action_type" \
    S22_PREFENCE_APPROVAL="$approval_path" \
    S22_PREFENCE_ATTESTATION="$attestation_path" \
    S22_PREFENCE_EXPECTED_VERIFIER="$S22_APPROVAL_BEGIN_VERIFIER" \
    S22_PREFENCE_EXPECTED_KEYS="$S22_APPROVAL_BEGIN_KEYS" \
    "$S22_PINNED_BUN" --no-env-file -e '
const {
  closeSync,
  constants,
  fstatSync,
  lstatSync,
  openSync,
  readSync,
  realpathSync,
} = require("node:fs");
const { createHash } = require("node:crypto");
const { spawnSync } = require("node:child_process");
const { dirname, resolve } = require("node:path");
const env = process.env;
const held = [];
let rejection = null;
const fail = (message) => {
  throw new Error(`install pre-fence attestation rejected: ${message}`);
};
const requireExact = (condition, message) => {
  if (!condition) fail(message);
};
const canonicalPath = (value, label) => {
  requireExact(
    typeof value === "string" &&
      value.length >= 1 &&
      value.length <= 4095 &&
      value.startsWith("/") &&
      !value.includes("\0") &&
      resolve(value) === value,
    `${label} path is not canonical`,
  );
  return value;
};
const modeOf = (status) =>
  Number(status.mode & 0o7777n).toString(8).padStart(4, "0");
const sameIdentity = (left, right) =>
  left.dev === right.dev && left.ino === right.ino;
const readHeld = (fd, size, label) => {
  const bytes = Buffer.alloc(size);
  let offset = 0;
  while (offset < size) {
    const count = readSync(fd, bytes, offset, size - offset, offset);
    requireExact(count > 0, `${label} ended before its retained size`);
    offset += count;
  }
  return bytes;
};
const openRegular = (pathValue, maximumBytes, label) => {
  const path = canonicalPath(pathValue, label);
  requireExact(realpathSync(path) === path, `${label} path moved`);
  const visible = lstatSync(path, { bigint: true });
  requireExact(visible.isFile(), `${label} is not a regular file`);
  const fd = openSync(
    path,
    constants.O_RDONLY | constants.O_CLOEXEC | constants.O_NOFOLLOW,
  );
  held.push(fd);
  const status = fstatSync(fd, { bigint: true });
  requireExact(
    status.isFile() && sameIdentity(visible, status),
    `${label} changed while it was opened`,
  );
  const size = Number(status.size);
  requireExact(
    Number.isSafeInteger(size) && size >= 1 && size <= maximumBytes,
    `${label} size is outside its bound`,
  );
  return { bytes: readHeld(fd, size, label), fd, path, size, status };
};
const exactFileFact = (value, label, maximumBytes) => {
  requireExact(
    value !== null && typeof value === "object" && !Array.isArray(value),
    `${label} fact is not an object`,
  );
  const expectedKeys = [
    "device", "gid", "inode", "link_count", "mode",
    "path", "sha256", "size_bytes", "uid",
  ];
  requireExact(
    JSON.stringify(Object.keys(value).sort()) ===
      JSON.stringify(expectedKeys),
    `${label} fact shape differs`,
  );
  requireExact(
    typeof value.sha256 === "string" &&
      /^[0-9a-f]{64}$/.test(value.sha256) &&
      Number.isSafeInteger(value.size_bytes) &&
      value.size_bytes >= 1 &&
      value.size_bytes <= maximumBytes &&
      typeof value.mode === "string" &&
      /^[0-7]{4}$/.test(value.mode) &&
      Number.isSafeInteger(value.uid) &&
      Number.isSafeInteger(value.gid) &&
      value.link_count === 1 &&
      typeof value.device === "string" &&
      /^[0-9]+$/.test(value.device) &&
      typeof value.inode === "string" &&
      /^[0-9]+$/.test(value.inode),
    `${label} fact fields differ`,
  );
  canonicalPath(value.path, label);
  return value;
};
const measureApprovedFile = (fact, label, maximumBytes) => {
  const observed = openRegular(fact.path, maximumBytes, label);
  requireExact(
    observed.size === fact.size_bytes &&
      modeOf(observed.status) === fact.mode &&
      Number(observed.status.uid) === fact.uid &&
      Number(observed.status.gid) === fact.gid &&
      Number(observed.status.nlink) === fact.link_count &&
      observed.status.dev.toString() === fact.device &&
      observed.status.ino.toString() === fact.inode &&
      createHash("sha256").update(observed.bytes).digest("hex") ===
        fact.sha256,
    `${label} differs from the retained approval`,
  );
  return observed;
};
const exactDirectoryFact = (value, label) => {
  requireExact(
    value !== null && typeof value === "object" && !Array.isArray(value),
    `${label} fact is not an object`,
  );
  const expectedKeys = ["device", "gid", "inode", "mode", "path", "uid"];
  requireExact(
    JSON.stringify(Object.keys(value).sort()) ===
      JSON.stringify(expectedKeys),
    `${label} fact shape differs`,
  );
  requireExact(
    typeof value.mode === "string" &&
      /^[0-7]{4}$/.test(value.mode) &&
      Number.isSafeInteger(value.uid) &&
      Number.isSafeInteger(value.gid) &&
      typeof value.device === "string" &&
      /^[0-9]+$/.test(value.device) &&
      typeof value.inode === "string" &&
      /^[0-9]+$/.test(value.inode),
    `${label} fact fields differ`,
  );
  canonicalPath(value.path, label);
  return value;
};
const holdApprovedDirectory = (fact, label) => {
  const path = canonicalPath(fact.path, label);
  requireExact(realpathSync(path) === path, `${label} path moved`);
  const visible = lstatSync(path, { bigint: true });
  requireExact(visible.isDirectory(), `${label} is not a directory`);
  const fd = openSync(
    path,
    constants.O_RDONLY | constants.O_DIRECTORY |
      constants.O_CLOEXEC | constants.O_NOFOLLOW,
  );
  held.push(fd);
  const status = fstatSync(fd, { bigint: true });
  requireExact(
    status.isDirectory() &&
      sameIdentity(visible, status) &&
      modeOf(status) === fact.mode &&
      Number(status.uid) === fact.uid &&
      Number(status.gid) === fact.gid &&
      status.dev.toString() === fact.device &&
      status.ino.toString() === fact.inode &&
      fact.uid === 0 &&
      fact.gid === 0 &&
      (Number.parseInt(fact.mode, 8) & 0o022) === 0,
    `${label} differs from the retained approval`,
  );
};
const directoryChain = (filePath) => {
  const chain = [];
  let current = dirname(filePath);
  while (true) {
    chain.push(current);
    if (current === "/") break;
    current = dirname(current);
  }
  return chain;
};
try {
  const approval = openRegular(
    env.S22_PREFENCE_APPROVAL,
    8 * 1024 * 1024,
    "retained approval",
  );
  const attestation = openRegular(
    env.S22_PREFENCE_ATTESTATION,
    1024 * 1024,
    "retained approval-begin attestation",
  );
  let parsed;
  try {
    parsed = JSON.parse(approval.bytes.toString("utf8"));
  } catch {
    fail("retained approval is not JSON");
  }
  requireExact(
    parsed !== null && typeof parsed === "object" &&
      parsed.action_type === env.S22_PREFENCE_ACTION_TYPE &&
      parsed.authorities !== null &&
      typeof parsed.authorities === "object",
    "retained approval action or authority surface differs",
  );
  const verifierFact = exactFileFact(
    parsed.authorities.approval_begin_verifier,
    "approved verifier",
    64 * 1024 * 1024,
  );
  requireExact(
    Array.isArray(parsed.authorities.approval_begin_public_keys) &&
      parsed.authorities.approval_begin_public_keys.length >= 1 &&
      parsed.authorities.approval_begin_public_keys.length <= 2,
    "approved public-key cardinality differs",
  );
  const keyFacts = parsed.authorities.approval_begin_public_keys.map(
    (value, index) =>
      exactFileFact(value, `approved public key ${index + 1}`, 1024 * 1024),
  );
  const approvedKeyPaths = keyFacts.map((fact) => fact.path);
  requireExact(
    verifierFact.path === env.S22_PREFENCE_EXPECTED_VERIFIER &&
      approvedKeyPaths.every((path) => !path.includes(",")) &&
      approvedKeyPaths.join(",") === env.S22_PREFENCE_EXPECTED_KEYS,
    "environment verifier or public-key paths differ from the retained approval",
  );
  requireExact(
    Array.isArray(parsed.authorities.root_ancestors) &&
      parsed.authorities.root_ancestors.length >= 1 &&
      parsed.authorities.root_ancestors.length <= 512,
    "approved ancestor cardinality differs",
  );
  const ancestorFacts = parsed.authorities.root_ancestors.map(
    (value, index) =>
      exactDirectoryFact(value, `approved ancestor ${index + 1}`),
  );
  const ancestorPaths = ancestorFacts.map((fact) => fact.path);
  requireExact(
    new Set(ancestorPaths).size === ancestorPaths.length &&
      JSON.stringify(ancestorPaths) ===
        JSON.stringify([...ancestorPaths].sort()),
    "approved ancestor closure is repeated or unordered",
  );
  const requiredAncestors = [
    verifierFact.path,
    ...approvedKeyPaths,
  ].flatMap(directoryChain);
  requireExact(
    requiredAncestors.every((path) => ancestorPaths.includes(path)),
    "approved ancestor closure does not cover verifier and keys",
  );
  ancestorFacts.forEach((fact, index) =>
    holdApprovedDirectory(fact, `approved ancestor ${index + 1}`)
  );
  const verifier = measureApprovedFile(
    verifierFact,
    "approved verifier",
    64 * 1024 * 1024,
  );
  const keys = keyFacts.map((fact, index) =>
    measureApprovedFile(
      fact,
      `approved public key ${index + 1}`,
      1024 * 1024,
    )
  );
  const identities = [approval, attestation, verifier, ...keys]
    .map(({ status }) => `${status.dev}:${status.ino}`);
  requireExact(
    new Set(identities).size === identities.length,
    "held verifier inputs alias",
  );
  const keyFds = keys.map((_, index) => 6 + index);
  const keyArgs = keyFds.flatMap((fd) => ["--key-fd", String(fd)]);
  const result = spawnSync(
    "/proc/self/fd/3",
    [
      "verify-v1",
      "--approval-fd", "4",
      "--attestation-fd", "5",
      "--action-type", env.S22_PREFENCE_ACTION_TYPE,
      ...keyArgs,
    ],
    {
      cwd: "/",
      env: {},
      encoding: "buffer",
      stdio: [
        "ignore", "pipe", "pipe",
        verifier.fd, approval.fd, attestation.fd,
        ...keys.map(({ fd }) => fd),
      ],
      timeout: 10000,
      killSignal: "SIGKILL",
      maxBuffer: 4096,
    },
  );
  requireExact(
    result.error === undefined &&
      result.status === 0 &&
      result.signal === null &&
      result.stdout?.byteLength === 0 &&
      result.stderr?.byteLength === 0,
    "held native verifier did not complete cleanly",
  );
} catch (error) {
  rejection = error;
} finally {
  for (const fd of held.reverse()) {
    try {
      closeSync(fd);
    } catch {}
  }
}
if (rejection !== null) {
  console.error(
    rejection instanceof Error ? rejection.message : String(rejection),
  );
  process.exitCode = 1;
}
'
)

install_prefence_gate_identity() {
  local retained fingerprint gate_id
  for retained in \
    "$INSTALL_APPROVAL" \
    "$INSTALL_APPROVAL_STDOUT" \
    "$INSTALL_GATE_REQUEST" \
    "$INSTALL_GATE_CREATE"
  do
    [[ -s $retained ]] || return 1
    install_require_retained_capture "$retained" || return 1
  done
  /usr/bin/cmp -- "$INSTALL_APPROVAL" "$INSTALL_APPROVAL_STDOUT" \
    || return 1
  fingerprint=$(
    run_s22_install_action_tool \
      approval-fingerprint --approval "$INSTALL_APPROVAL"
  ) || return 1
  [[ $fingerprint =~ ^[0-9a-f]{64}$ ]] || return 1
  gate_id=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg fingerprint "$fingerprint" \
      --slurpfile approval "$INSTALL_APPROVAL" '
        select(
          .action_type == "host.s22_measured_broker_install"
          and .action_fingerprint == $fingerprint
          and .action_payload == $approval[0]
        )
        | .id
      ' "$INSTALL_GATE_CREATE"
  ) || return 1
  [[ $gate_id =~ ^approval_gate: ]] || return 1
  /usr/bin/printf '%s\t%s\n' "$gate_id" "$fingerprint"
}

install_require_canonical_rfc3339_milliseconds() {
  local timestamp=$1
  local roundtrip
  [[ $timestamp =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z$ ]] \
    || return 1
  roundtrip=$(
    /usr/bin/date --utc --date="$timestamp" '+%Y-%m-%dT%H:%M:%S.%3NZ'
  ) || return 1
  [[ $roundtrip == "$timestamp" ]]
}

install_token_expiry_has_elapsed() {
  local token_expires_at=$1
  local now
  install_require_canonical_rfc3339_milliseconds "$token_expires_at" \
    || return 1
  now=$(
    /usr/bin/date --utc '+%Y-%m-%dT%H:%M:%S.%3NZ'
  ) || return 1
  install_require_canonical_rfc3339_milliseconds "$now" || return 1
  [[ $now == "$token_expires_at" || $now > "$token_expires_at" ]]
}

install_capture_prefence_gate_observation() {
  local gate_id=$1
  local fingerprint=$2
  local observation_base=$INSTALL_PREFENCE_GATE_OBSERVATION
  INSTALL_PREFENCE_GATE_OBSERVATION=$observation_base
  install_select_reusable_capture INSTALL_PREFENCE_GATE_OBSERVATION || :
  INSTALL_PREFENCE_GATE_OBSERVATION=\
"$INSTALL_PREFENCE_GATE_OBSERVATION_NEXT"
  install_capture_stdout "$INSTALL_PREFENCE_GATE_OBSERVATION" \
    run_s22_install_chorus_cli approvals get "$gate_id" \
    --profile inu --json || :
  install_require_retained_capture \
    "$INSTALL_PREFENCE_GATE_OBSERVATION" || return 1
  /usr/bin/jq --exit-status \
    --arg gate "$gate_id" \
    --arg fingerprint "$fingerprint" \
    --slurpfile approval "$INSTALL_APPROVAL" '
      .id == $gate
      and .action_type == "host.s22_measured_broker_install"
      and .action_fingerprint == $fingerprint
      and .action_payload == $approval[0]
      and (
        .status == "pending"
        or .status == "approved"
        or .status == "denied"
        or .status == "cancelled"
      )
    ' "$INSTALL_PREFENCE_GATE_OBSERVATION" >/dev/null
}

install_prefence_finish_is_terminal_failure() {
  local response_path=$1
  local gate_id=$2
  local attempt_id=$3
  local fingerprint=$4
  local revision=$5
  local state
  state=$(
    install_finish_state_from_capture \
      "$response_path" "$gate_id" "$attempt_id" "$fingerprint" "$revision"
  ) || return 1
  [[ $state == failed || $state == abandoned ]] || return 1
  /usr/bin/jq --exit-status \
    '."attempt"."last_error" == "s22_install_prelaunch_interrupted"' \
    "$response_path" >/dev/null
}

install_close_prefence_attempt() {
  local gate_id=$1
  local attempt_id=$2
  local fingerprint=$3
  local revision=$4
  local response_base=$INSTALL_PREFENCE_FINISH_RESPONSE
  local had_capture=false
  if install_select_reusable_capture INSTALL_PREFENCE_FINISH_RESPONSE; then
    had_capture=true
    if install_prefence_finish_is_terminal_failure \
      "$INSTALL_PREFENCE_FINISH_RESPONSE" \
      "$gate_id" "$attempt_id" "$fingerprint" "$revision"
    then
      return 0
    fi
  fi
  if [[ $had_capture == true ]]; then
    INSTALL_PREFENCE_FINISH_RESPONSE=$response_base
    install_select_reusable_capture INSTALL_PREFENCE_FINISH_RESPONSE || :
    INSTALL_PREFENCE_FINISH_RESPONSE=$INSTALL_PREFENCE_FINISH_RESPONSE_NEXT
  fi
  install_capture_stdout "$INSTALL_PREFENCE_FINISH_RESPONSE" \
    run_s22_install_chorus_cli approvals execution finish \
    --attempt-id "$attempt_id" \
    --approval-response "$INSTALL_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$fingerprint" \
    --revision "$revision" \
    --outcome terminal_failure \
    --error "s22_install_prelaunch_interrupted" \
    --profile inu --json || :
  install_prefence_finish_is_terminal_failure \
    "$INSTALL_PREFENCE_FINISH_RESPONSE" \
    "$gate_id" "$attempt_id" "$fingerprint" "$revision"
}

install_recover_consumed_prefence_attempt() {
  local gate_id=$1
  local fingerprint=$2
  local attempt_id="s22-install-${fingerprint:0:64}"
  local begin_base=$INSTALL_PREFENCE_BEGIN_OBSERVATION
  local attestation_base=$INSTALL_PREFENCE_RESUME_ATTESTATION
  local begin_identity begin_status begin_revision begin_state
  local begin_attempt_state

  install_require_retained_capture "$INSTALL_APPROVAL_RESPONSE" || return 1
  /usr/bin/jq --exit-status \
    --arg gate "$gate_id" \
    --arg fingerprint "$fingerprint" '
      (.data // .gate // .) as $response
      | $response.id == $gate
      and $response.action_fingerprint == $fingerprint
      and (
        (.execution_token // .data.execution_token // .gate.execution_token)
        | if type == "object" then .token else . end
        | type == "string" and length >= 1 and length <= 512
      )
    ' "$INSTALL_APPROVAL_RESPONSE" >/dev/null || return 1

  INSTALL_PREFENCE_BEGIN_OBSERVATION=$begin_base
  install_select_reusable_capture INSTALL_PREFENCE_BEGIN_OBSERVATION || :
  INSTALL_PREFENCE_BEGIN_OBSERVATION=\
"$INSTALL_PREFENCE_BEGIN_OBSERVATION_NEXT"
  INSTALL_PREFENCE_RESUME_ATTESTATION=$attestation_base
  install_select_reusable_capture INSTALL_PREFENCE_RESUME_ATTESTATION || :
  INSTALL_PREFENCE_RESUME_ATTESTATION=\
"$INSTALL_PREFENCE_RESUME_ATTESTATION_NEXT"

  begin_status=0
  if install_capture_stdout "$INSTALL_PREFENCE_BEGIN_OBSERVATION" \
    run_s22_install_chorus_cli approvals execution begin \
    --attempt-id "$attempt_id" \
    --approval-response "$INSTALL_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$fingerprint" \
    --attestation-output "$INSTALL_PREFENCE_RESUME_ATTESTATION" \
    --profile inu --json
  then
    :
  else
    begin_status=$?
  fi
  install_require_retained_capture \
    "$INSTALL_PREFENCE_BEGIN_OBSERVATION" || return 1
  begin_identity=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg gate "$gate_id" \
      --arg attempt "$attempt_id" \
      --arg fingerprint "$fingerprint" '
        select(
          .attempt.gate_id == $gate
          and .attempt.attempt_id == $attempt
          and .attempt.request_fingerprint == $fingerprint
          and (.attempt.revision | type == "number" and . >= 1 and floor == .)
          and (
            (
              .status == "observed_in_flight"
              and .execution_authorized == false
              and .attempt.state == "accepted"
            )
            or (
              .status == "observed_completed"
              and .execution_authorized == false
              and (
                .attempt.state == "failed"
                or .attempt.state == "abandoned"
              )
            )
            or (
              .status == "resumed"
              and .execution_authorized == true
              and .attempt.state == "accepted"
              and .attestation.payload.gate_id == $gate
              and .attestation.payload.attempt == .attempt
              and .attestation.payload.execution_authorized == true
              and (.attestation.signature_base64url |
                type == "string" and length > 0)
            )
          )
        )
        | [.status, (.attempt.revision | tostring), .attempt.state]
        | @tsv
      ' "$INSTALL_PREFENCE_BEGIN_OBSERVATION"
  ) || return 1
  IFS=$'\t' read -r begin_state begin_revision begin_attempt_state \
    <<<"$begin_identity"
  [[ $begin_revision =~ ^[1-9][0-9]*$ ]] || return 1

  case "$begin_state" in
    resumed)
      test "$begin_status" -eq 0 || return 1
      install_require_retained_capture \
        "$INSTALL_PREFENCE_RESUME_ATTESTATION" || return 1
      /usr/bin/jq --exit-status \
        --slurpfile retained_attestation \
          "$INSTALL_PREFENCE_RESUME_ATTESTATION" '
          .attestation == $retained_attestation[0].attestation
        ' "$INSTALL_PREFENCE_BEGIN_OBSERVATION" >/dev/null || return 1
      install_verify_prefence_attestation \
        host.s22_measured_broker_install \
        "$INSTALL_APPROVAL" "$INSTALL_PREFENCE_RESUME_ATTESTATION" \
        || return 1
      ;;
    observed_in_flight)
      test "$begin_status" -ne 0 || return 1
      test ! -e "$INSTALL_PREFENCE_RESUME_ATTESTATION" \
        -a ! -L "$INSTALL_PREFENCE_RESUME_ATTESTATION" || return 1
      ;;
    observed_completed)
      test "$begin_status" -ne 0 || return 1
      test "$begin_revision" -gt 1 || return 1
      begin_revision=$((begin_revision - 1))
      ;;
    *) return 1 ;;
  esac

  install_close_prefence_attempt \
    "$gate_id" "$attempt_id" "$fingerprint" "$begin_revision"
}

install_quarantine_prefence_state() {
  test ! -e "$INSTALL_PREFENCE_QUARANTINE" \
    -a ! -L "$INSTALL_PREFENCE_QUARANTINE"
  /usr/bin/mv --no-clobber -T -- \
    "$S22_INSTALL_STATE" "$INSTALL_PREFENCE_QUARANTINE"
  test ! -e "$S22_INSTALL_STATE" -a ! -L "$S22_INSTALL_STATE"
  install_assert_owner_directory "$INSTALL_PREFENCE_QUARANTINE"
  /usr/bin/sync -d "$S22_INSTALL_STATE_PARENT"
  /usr/bin/printf \
    'quarantined pre-fence install state; allocate a fresh canonical state\n' \
    >&2
  exit 75
}

install_resolve_prefence_state() {
  local remote_capture gate_identity gate_id fingerprint gate_fields
  local gate_status resolution_reason token_expires_at token_consumed_at
  [[ $INSTALL_PREFENCE_MODE == true ]] || return 0

  if [[ ! -e $INSTALL_GATE_CREATE && ! -L $INSTALL_GATE_CREATE ]]; then
    for remote_capture in \
      "$INSTALL_APPROVAL_RESPONSE" \
      "$INSTALL_ATTESTATION" \
      "$INSTALL_BEGIN_RESPONSE" \
      "$INSTALL_LAUNCH_START"
    do
      test ! -e "$remote_capture" -a ! -L "$remote_capture" || return 1
    done
    install_quarantine_prefence_state
  fi

  gate_identity=$(install_prefence_gate_identity) || return 1
  IFS=$'\t' read -r gate_id fingerprint <<<"$gate_identity"
  install_capture_prefence_gate_observation \
    "$gate_id" "$fingerprint" || return 1
  gate_fields=$(
    /usr/bin/jq --exit-status --raw-output '
      [
        .status,
        (.resolution_reason // ""),
        (.execution_token_expires_at // ""),
        (.execution_token_consumed_at // "")
      ]
      | @tsv
    ' "$INSTALL_PREFENCE_GATE_OBSERVATION"
  ) || return 1
  IFS=$'\t' read -r gate_status resolution_reason \
    token_expires_at token_consumed_at <<<"$gate_fields"

  case "$gate_status" in
    pending)
      return 1
      ;;
    denied)
      [[ $resolution_reason == denied \
        || $resolution_reason == timeout \
        || $resolution_reason == escalation_exhausted ]] || return 1
      install_quarantine_prefence_state
      ;;
    cancelled)
      [[ $resolution_reason == cancelled ]] || return 1
      install_quarantine_prefence_state
      ;;
    approved)
      [[ $resolution_reason == approved ]] || return 1
      if [[ -z $token_consumed_at ]]; then
        [[ -n $token_expires_at ]] || return 1
        install_token_expiry_has_elapsed "$token_expires_at" || return 1
      else
        install_recover_consumed_prefence_attempt \
          "$gate_id" "$fingerprint" || return 1
      fi
      install_quarantine_prefence_state
      ;;
    *) return 1 ;;
  esac
}

INSTALL_APPROVAL="$S22_INSTALL_STATE/approval.json"
INSTALL_APPROVAL_STDOUT="$S22_INSTALL_STATE/approval.stdout.json"
INSTALL_GATE_REQUEST="$S22_INSTALL_STATE/gate-request.json"
INSTALL_GATE_CREATE="$S22_INSTALL_STATE/gate-create.json"
INSTALL_APPROVAL_RESPONSE="$S22_INSTALL_STATE/approval-response.json"
INSTALL_ATTESTATION="$S22_INSTALL_STATE/approval-begin-attestation.json"
INSTALL_BEGIN_RESPONSE="$S22_INSTALL_STATE/execution-begin.json"
INSTALL_LAUNCH_START="$S22_INSTALL_STATE/launch-start.json"
INSTALL_LAUNCH_PUBLICATION="$S22_INSTALL_STATE/launch-publication.json"
INSTALL_RECONSTRUCTED_PUBLICATION="$S22_INSTALL_STATE/reconstructed-publication.json"
INSTALL_PRIVILEGED_ARGV_NUL="$S22_INSTALL_STATE/privileged-argv.nul"
INSTALL_ROOT_RESULT="$S22_INSTALL_STATE/root-result.txt"
INSTALL_RECONCILIATION_ARGV_NUL="$S22_INSTALL_STATE/reconciliation-argv.nul"
INSTALL_RECONCILIATION="$S22_INSTALL_STATE/reconciliation.json"
INSTALL_FINISH_RESPONSE="$S22_INSTALL_STATE/execution-finish.json"
INSTALL_PREFENCE_GATE_OBSERVATION=\
"$S22_INSTALL_STATE/pre-fence-gate-observation.json"
INSTALL_PREFENCE_BEGIN_OBSERVATION=\
"$S22_INSTALL_STATE/pre-fence-execution-begin.json"
INSTALL_PREFENCE_RESUME_ATTESTATION=\
"$S22_INSTALL_STATE/pre-fence-resume-attestation.json"
INSTALL_PREFENCE_FINISH_RESPONSE="$S22_INSTALL_STATE/pre-fence-execution-finish.json"
INSTALL_PREFENCE_QUARANTINE=\
"$S22_INSTALL_STATE_PARENT/quarantine-$(
  /usr/bin/basename -- "$S22_INSTALL_STATE"
)-pre-fence"
test "$(/usr/bin/dirname -- "$INSTALL_PREFENCE_QUARANTINE")" = \
  "$S22_INSTALL_STATE_PARENT"
test "$INSTALL_PREFENCE_QUARANTINE" != "$S22_INSTALL_STATE"

for install_capture in \
  "$INSTALL_APPROVAL" \
  "$INSTALL_APPROVAL_STDOUT" \
  "$INSTALL_GATE_REQUEST" \
  "$INSTALL_GATE_CREATE" \
  "$INSTALL_APPROVAL_RESPONSE" \
  "$INSTALL_ATTESTATION" \
  "$INSTALL_BEGIN_RESPONSE" \
  "$INSTALL_LAUNCH_START" \
  "$INSTALL_LAUNCH_PUBLICATION" \
  "$INSTALL_RECONSTRUCTED_PUBLICATION" \
  "$INSTALL_PRIVILEGED_ARGV_NUL" \
  "$INSTALL_ROOT_RESULT" \
  "$INSTALL_RECONCILIATION_ARGV_NUL" \
  "$INSTALL_RECONCILIATION" \
  "$INSTALL_FINISH_RESPONSE" \
  "$INSTALL_PREFENCE_GATE_OBSERVATION" \
  "$INSTALL_PREFENCE_BEGIN_OBSERVATION" \
  "$INSTALL_PREFENCE_RESUME_ATTESTATION" \
  "$INSTALL_PREFENCE_FINISH_RESPONSE"
do
  if [[ -e $install_capture || -L $install_capture ]]; then
    install_assert_capture_file "$install_capture"
  fi
done

install_resolve_prefence_state
INSTALL_NEW_LAUNCH=false
# END S22 INSTALL REBOOT RESUME CUSTODY

# A retained state directory without a valid launch-start is pre-fence
# incomplete, not normal recovery, and can never enter the first-attempt branch
# again. If gate creation never started, exclusively quarantine it. Otherwise
# take a fresh exact gate observation. A pending gate remains in place until it
# is denied or cancelled. An approved unconsumed capability remains in place
# until its exact expiry has elapsed. For an approved consumed capability,
# re-begin only the deterministic retained attempt with the exact token and
# fingerprint. An observed attempt never authorizes work; a resumed attempt's
# new attestation is verified before its accepted revision is finished with
# terminal_failure and s22_install_prelaunch_interrupted. No pre-fence path
# creates or approves a replacement gate, writes launch-start, or dispatches
# host work. Quarantine is an exclusive no-clobber rename, the parent is synced,
# and exit 75 prevents same-shell allocation of a replacement state.

# All authority creation is first-attempt-only. Recovery requires the complete
# bound pre-fence record set and cannot repeat approval, begin, or launch-start.
if [[ $INSTALL_RECOVERY_MODE == false ]]; then
  install_assert_new_capture_path "$INSTALL_APPROVAL"
  install_capture_stdout "$INSTALL_APPROVAL_STDOUT" \
    run_s22_install_action_tool approval-payload \
    --candidate "$ROOT_STAGING_CANDIDATE" \
    --bun "$S22_PINNED_BUN" \
    --action-tool "$S22_INSTALL_ACTION_TOOL" \
    --executor "$S22_INSTALL_EXECUTOR" \
    --verifier "$S22_INSTALL_VERIFIER" \
    --approval-begin-verifier "$S22_APPROVAL_BEGIN_VERIFIER" \
    --approval-begin-keys "$S22_APPROVAL_BEGIN_KEYS" \
    --approval-schema "$S22_INSTALL_APPROVAL_SCHEMA" \
    --receipt-schema "$S22_INSTALL_RECEIPT_SCHEMA" \
    --initial-host-probe-build-receipt "$S22_INITIAL_HOST_PROBE_BUILD_RECEIPT" \
    --output "$INSTALL_APPROVAL"
  install_assert_capture_file "$INSTALL_APPROVAL"
  /usr/bin/cmp -- "$INSTALL_APPROVAL" "$INSTALL_APPROVAL_STDOUT"

  INSTALL_FINGERPRINT=$(
    run_s22_install_action_tool approval-fingerprint \
      --approval "$INSTALL_APPROVAL"
  )
  [[ $INSTALL_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]

  install_capture_stdout "$INSTALL_GATE_REQUEST" /usr/bin/jq -nS \
    --arg type host.s22_measured_broker_install \
    --arg summary \
      "Install exactly one approved measured broker; no invocation, service, traffic, network, or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$INSTALL_APPROVAL" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "critical",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    '
  install_capture_stdout "$INSTALL_GATE_CREATE" \
    run_s22_install_chorus_cli approvals create \
    --profile inu --from-file "$INSTALL_GATE_REQUEST" --json
  /usr/bin/jq --exit-status \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --slurpfile approval "$INSTALL_APPROVAL" '
      .action_type == "host.s22_measured_broker_install"
      and .action_fingerprint == $fingerprint
      and .action_payload == $approval[0]
      and .risk_level == "critical"
      and .status == "pending"
    ' "$INSTALL_GATE_CREATE" >/dev/null
  S22_INSTALL_GATE_ID=$(
    /usr/bin/jq --exit-status --raw-output '.id' "$INSTALL_GATE_CREATE"
  )

  # HUMAN CHECKPOINT: inspect INSTALL_APPROVAL, then approve this gate once.
  install_capture_stdout "$INSTALL_APPROVAL_RESPONSE" \
    run_s22_install_chorus_cli approvals approve \
    "$S22_INSTALL_GATE_ID" --profile inu \
    --note "I authorize exactly this measured broker installation, with no invocation, service, traffic, network, or deployment." \
    --json

  S22_INSTALL_ATTEMPT_ID="s22-install-${INSTALL_FINGERPRINT:0:64}"
  install_assert_new_capture_path "$INSTALL_ATTESTATION"
  install_capture_stdout "$INSTALL_BEGIN_RESPONSE" \
    run_s22_install_chorus_cli approvals execution begin \
    --attempt-id "$S22_INSTALL_ATTEMPT_ID" \
    --approval-response "$INSTALL_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INSTALL_FINGERPRINT" \
    --attestation-output "$INSTALL_ATTESTATION" \
    --profile inu --json
  install_assert_capture_file "$INSTALL_ATTESTATION"

  INSTALL_REVISION=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg gate "$S22_INSTALL_GATE_ID" \
      --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
      --arg fingerprint "$INSTALL_FINGERPRINT" '
        select(
          (."status" == "accepted" or ."status" == "resumed")
          and ."execution_authorized" == true
          and ."attempt"."gate_id" == $gate
          and ."attempt"."attempt_id" == $attempt
          and ."attempt"."request_fingerprint" == $fingerprint
          and (."attempt"."revision" | type == "number" and . >= 1 and floor == .)
        )
        | ."attempt"."revision"
      ' "$INSTALL_BEGIN_RESPONSE"
  )

  install_assert_new_capture_path "$INSTALL_LAUNCH_START"
  install_capture_stdout "$INSTALL_LAUNCH_PUBLICATION" \
    run_s22_install_action_tool launch-start \
    --approval "$INSTALL_APPROVAL" \
    --approval-attestation "$INSTALL_ATTESTATION" \
    --path "$INSTALL_LAUNCH_START" \
    --expected-gate-id "$S22_INSTALL_GATE_ID" \
    --expected-attempt-id "$S22_INSTALL_ATTEMPT_ID"
  install_assert_capture_file "$INSTALL_LAUNCH_START"
  INSTALL_LAUNCH_START_SHA256=$(
    /usr/bin/sha256sum -- "$INSTALL_LAUNCH_START" \
      | /usr/bin/cut -d' ' -f1
  )
  INSTALL_LAUNCH_START_SIZE=$(
    /usr/bin/stat -Lc '%s' -- "$INSTALL_LAUNCH_START"
  )
  INSTALL_LAUNCH_PUBLICATION_SHA256=$(
    /usr/bin/sha256sum -- "$INSTALL_LAUNCH_PUBLICATION" \
      | /usr/bin/cut -d' ' -f1
  )
  INSTALL_NEW_LAUNCH=true
else
  # BEGIN S22 INSTALL RETAINED STATE VALIDATION
  for install_retained in \
    "$INSTALL_APPROVAL" \
    "$INSTALL_APPROVAL_STDOUT" \
    "$INSTALL_GATE_REQUEST" \
    "$INSTALL_GATE_CREATE" \
    "$INSTALL_APPROVAL_RESPONSE" \
    "$INSTALL_ATTESTATION" \
    "$INSTALL_BEGIN_RESPONSE" \
    "$INSTALL_LAUNCH_START"
  do
    install_require_retained_capture "$install_retained"
  done
  /usr/bin/cmp -- "$INSTALL_APPROVAL" "$INSTALL_APPROVAL_STDOUT"

  INSTALL_FINGERPRINT=$(
    run_s22_install_action_tool approval-fingerprint \
      --approval "$INSTALL_APPROVAL"
  )
  [[ $INSTALL_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
  S22_INSTALL_GATE_ID=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_gate_id' "$INSTALL_LAUNCH_START"
  )
  S22_INSTALL_ATTEMPT_ID=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_attempt_id' "$INSTALL_LAUNCH_START"
  )
  INSTALL_REVISION=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_revision' "$INSTALL_LAUNCH_START"
  )
  [[ $S22_INSTALL_GATE_ID =~ ^approval_gate: ]]
  [[ $S22_INSTALL_ATTEMPT_ID =~ ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ ]]
  [[ $INSTALL_REVISION =~ ^[1-9][0-9]*$ ]]
  INSTALL_APPROVAL_SHA256=$(
    /usr/bin/sha256sum -- "$INSTALL_APPROVAL" | /usr/bin/cut -d' ' -f1
  )
  INSTALL_APPROVAL_SIZE=$(/usr/bin/stat -Lc '%s' -- "$INSTALL_APPROVAL")

  /usr/bin/jq --exit-status '
    .schema_version == "chorus.s22-measured-broker-install-approval/1"
    and .action_type == "host.s22_measured_broker_install"
  ' "$INSTALL_APPROVAL" >/dev/null
  /usr/bin/jq --exit-status \
    --slurpfile approval "$INSTALL_APPROVAL" '
      .action_type == "host.s22_measured_broker_install"
      and .action_payload == $approval[0]
      and .risk_level == "critical"
      and .approval_policy.mode == "any"
      and .offline_fallback.enabled == false
    ' "$INSTALL_GATE_REQUEST" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --slurpfile approval "$INSTALL_APPROVAL" '
      .id == $gate
      and .action_type == "host.s22_measured_broker_install"
      and .action_fingerprint == $fingerprint
      and .action_payload == $approval[0]
      and (.status == "pending" or .status == "approved")
    ' "$INSTALL_GATE_CREATE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" '
      (.data // .gate // .) as $response
      | $response.id == $gate
      and $response.action_fingerprint == $fingerprint
      and (
        (.execution_token // .data.execution_token // .gate.execution_token)
        | if type == "object" then .token else . end
        | type == "string" and length >= 1 and length <= 512
      )
    ' "$INSTALL_APPROVAL_RESPONSE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --arg revision "$INSTALL_REVISION" '
      .attestation.payload.schema_version ==
        "chorus.approval-execution-begin-attestation/1"
      and .attestation.payload.gate_action_type ==
        "host.s22_measured_broker_install"
      and .attestation.payload.gate_id == $gate
      and .attestation.payload.execution_authorized == true
      and .attestation.payload.attempt.gate_id == $gate
      and .attestation.payload.attempt.attempt_id == $attempt
      and .attestation.payload.attempt.request_fingerprint == $fingerprint
      and (.attestation.payload.attempt.revision | tostring) == $revision
      and (.attestation.signature_base64url | type == "string" and length > 0)
    ' "$INSTALL_ATTESTATION" >/dev/null
  install_verify_prefence_attestation \
    host.s22_measured_broker_install \
    "$INSTALL_APPROVAL" "$INSTALL_ATTESTATION"
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --arg revision "$INSTALL_REVISION" '
      (."status" == "accepted" or ."status" == "resumed")
      and ."execution_authorized" == true
      and ."attempt"."gate_id" == $gate
      and ."attempt"."attempt_id" == $attempt
      and ."attempt"."request_fingerprint" == $fingerprint
      and .attempt.state == "accepted"
      and (."attempt"."revision" | tostring) == $revision
    ' "$INSTALL_BEGIN_RESPONSE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg approval "$INSTALL_APPROVAL" \
    --arg approval_sha256 "$INSTALL_APPROVAL_SHA256" \
    --argjson approval_size "$INSTALL_APPROVAL_SIZE" \
    --argjson owner_uid "$INSTALL_OPERATOR_UID" \
    --argjson owner_gid "$INSTALL_OPERATOR_GID" \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --arg revision "$INSTALL_REVISION" '
      .schema_version == "chorus.s22-measured-broker-install-launch-start/1"
      and .action_type == "host.s22_measured_broker_install"
      and .approval_fingerprint == $fingerprint
      and .approval_file.path == $approval
      and .approval_file.sha256 == $approval_sha256
      and .approval_file.size_bytes == $approval_size
      and .approval_file.mode == "0600"
      and .approval_file.uid == $owner_uid
      and .approval_file.gid == $owner_gid
      and .approval_file.link_count == 1
      and .authorization.approval_gate_id == $gate
      and .authorization.approval_attempt_id == $attempt
      and .authorization.request_fingerprint == $fingerprint
      and .authorization.approval_revision == $revision
      and .authorization.execution_authorized == true
      and .state == "sudo-dispatch-started"
      and .root_launch_may_have_begun == true
      and .repeat_privileged_launch == false
      and .production_deploy == false
    ' "$INSTALL_LAUNCH_START" >/dev/null
  INSTALL_NEW_LAUNCH=false
  # END S22 INSTALL RETAINED STATE VALIDATION
fi
INSTALL_LAUNCH_START_SHA256=$(
  /usr/bin/sha256sum -- "$INSTALL_LAUNCH_START" | /usr/bin/cut -d' ' -f1
)
INSTALL_LAUNCH_START_SIZE=$(
  /usr/bin/stat -Lc '%s' -- "$INSTALL_LAUNCH_START"
)

Only the uninterrupted operator that just durably created that launch-start may execute the publication’s privileged_argv, exactly once. Preserve the root command’s status and output. If its result or the terminal became uncertain, never execute the privileged vector again:

# BEGIN S22 INSTALL PRIVILEGED PUBLICATION VALIDATION
INSTALL_ROOT_STATUS=125
if [[ $INSTALL_NEW_LAUNCH == true && -s $INSTALL_LAUNCH_PUBLICATION ]]; then
  install_assert_capture_file "$INSTALL_LAUNCH_PUBLICATION"
  test "$(/usr/bin/realpath -e -- "$INSTALL_LAUNCH_PUBLICATION")" = \
    "$INSTALL_LAUNCH_PUBLICATION"
  test "$(/usr/bin/sha256sum -- "$INSTALL_LAUNCH_PUBLICATION")" = \
    "$INSTALL_LAUNCH_PUBLICATION_SHA256  $INSTALL_LAUNCH_PUBLICATION"
  /usr/bin/jq --exit-status \
    --arg launch_start "$INSTALL_LAUNCH_START" \
    --arg launch_start_sha256 "$INSTALL_LAUNCH_START_SHA256" \
    --argjson launch_start_size "$INSTALL_LAUNCH_START_SIZE" \
    --argjson owner_uid "$INSTALL_OPERATOR_UID" \
    --argjson owner_gid "$INSTALL_OPERATOR_GID" \
    --arg gate "$S22_INSTALL_GATE_ID" \
    --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
    --arg fingerprint "$INSTALL_FINGERPRINT" \
    --arg revision "$INSTALL_REVISION" '
      .schema_version ==
        "chorus.s22-measured-broker-install-launch-publication/1"
      and .file.path == $launch_start
      and .file.sha256 == $launch_start_sha256
      and .file.size_bytes == $launch_start_size
      and .file.mode == "0600"
      and .file.uid == $owner_uid
      and .file.gid == $owner_gid
      and .file.link_count == 1
      and .launch_start.authorization.approval_gate_id == $gate
      and .launch_start.authorization.approval_attempt_id == $attempt
      and .launch_start.authorization.request_fingerprint == $fingerprint
      and .launch_start.authorization.approval_revision == $revision
      and .launch_start.authorization.execution_authorized == true
      and .launch_start.repeat_privileged_launch == false
      and .repeat_privileged_launch == false
      and .production_deploy == false
      and (.privileged_argv | type == "array" and length > 0
        and all(.[];
          type == "string" and length > 0
          and (index("\u0000") == null)))
    ' "$INSTALL_LAUNCH_PUBLICATION" >/dev/null
  INSTALL_EXPECTED_PRIVILEGED_ARGV_COUNT=$(
    /usr/bin/jq --exit-status --raw-output \
      '.privileged_argv | length' "$INSTALL_LAUNCH_PUBLICATION"
  )
  install_capture_stdout "$INSTALL_PRIVILEGED_ARGV_NUL" \
    /usr/bin/jq --join-output '.privileged_argv[] | . + "\u0000"' \
    "$INSTALL_LAUNCH_PUBLICATION"
  mapfile -d '' -t INSTALL_PRIVILEGED_ARGV \
    <"$INSTALL_PRIVILEGED_ARGV_NUL"
  test "${#INSTALL_PRIVILEGED_ARGV[@]}" -eq \
    "$INSTALL_EXPECTED_PRIVILEGED_ARGV_COUNT"
  install_assert_capture_file "$INSTALL_LAUNCH_PUBLICATION"
  test "$(/usr/bin/sha256sum -- "$INSTALL_LAUNCH_PUBLICATION")" = \
    "$INSTALL_LAUNCH_PUBLICATION_SHA256  $INSTALL_LAUNCH_PUBLICATION"
  install_assert_toolchain
  if install_capture_stdout "$INSTALL_ROOT_RESULT" \
    "${INSTALL_PRIVILEGED_ARGV[@]}"
  then
    INSTALL_ROOT_STATUS=0
  else
    INSTALL_ROOT_STATUS=$?
  fi
fi
# END S22 INSTALL PRIVILEGED PUBLICATION VALIDATION

The durable launch-start is the no-replay fence. If publication stdout was lost, use reconstruct-launch only to recover the audit and reconciliation vectors; reconstruction never authorizes another privileged launch:

# BEGIN S22 INSTALL RECONSTRUCTION RECONCILIATION
INSTALL_RECONCILIATION_VERIFIED=false
INSTALL_PUBLICATION_VERIFIED=false
INSTALL_EFFECTIVE_PUBLICATION=
install_require_retained_capture "$INSTALL_LAUNCH_START"
install_verify_prefence_attestation \
  host.s22_measured_broker_install \
  "$INSTALL_APPROVAL" "$INSTALL_ATTESTATION"
install_select_reusable_capture INSTALL_RECONSTRUCTED_PUBLICATION || :
INSTALL_RECONSTRUCTED_PUBLICATION=$INSTALL_RECONSTRUCTED_PUBLICATION_NEXT
INSTALL_RECONSTRUCTION_STATUS=0
if install_capture_stdout "$INSTALL_RECONSTRUCTED_PUBLICATION" \
  run_s22_install_action_tool reconstruct-launch \
    --approval "$INSTALL_APPROVAL" \
    --approval-attestation "$INSTALL_ATTESTATION" \
    --launch-start "$INSTALL_LAUNCH_START" \
    --expected-gate-id "$S22_INSTALL_GATE_ID" \
    --expected-attempt-id "$S22_INSTALL_ATTEMPT_ID"
then
  INSTALL_EFFECTIVE_PUBLICATION=$INSTALL_RECONSTRUCTED_PUBLICATION
else
  INSTALL_RECONSTRUCTION_STATUS=$?
fi

if [[ -n $INSTALL_EFFECTIVE_PUBLICATION ]] && /usr/bin/jq --exit-status \
  --arg launch_start "$INSTALL_LAUNCH_START" \
  --arg launch_start_sha256 "$INSTALL_LAUNCH_START_SHA256" \
  --argjson launch_start_size "$INSTALL_LAUNCH_START_SIZE" \
  --argjson owner_uid "$INSTALL_OPERATOR_UID" \
  --argjson owner_gid "$INSTALL_OPERATOR_GID" \
  --arg gate "$S22_INSTALL_GATE_ID" \
  --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
  --arg fingerprint "$INSTALL_FINGERPRINT" \
  --arg revision "$INSTALL_REVISION" '
    .schema_version ==
      "chorus.s22-measured-broker-install-launch-publication/1"
    and .file.path == $launch_start
    and .file.sha256 == $launch_start_sha256
    and .file.size_bytes == $launch_start_size
    and .file.mode == "0600"
    and .file.uid == $owner_uid
    and .file.gid == $owner_gid
    and .file.link_count == 1
    and .launch_start.action_type == "host.s22_measured_broker_install"
    and .launch_start.authorization.approval_gate_id == $gate
    and .launch_start.authorization.approval_attempt_id == $attempt
    and .launch_start.authorization.request_fingerprint == $fingerprint
    and .launch_start.authorization.approval_revision == $revision
    and .launch_start.authorization.execution_authorized == true
    and .launch_start.root_launch_may_have_begun == true
    and .launch_start.repeat_privileged_launch == false
    and .repeat_privileged_launch == false
    and .production_deploy == false
    and (.reconciliation_argv | type == "array" and length > 0
      and all(.[];
        type == "string" and length > 0
        and (index("\u0000") == null)))
  ' "$INSTALL_EFFECTIVE_PUBLICATION" >/dev/null
then
  INSTALL_PUBLICATION_VERIFIED=true
fi

if [[ $INSTALL_PUBLICATION_VERIFIED == true ]]; then
  INSTALL_EXPECTED_RECONCILIATION_ARGV_COUNT=$(
    /usr/bin/jq --exit-status --raw-output \
      '.reconciliation_argv | length' "$INSTALL_EFFECTIVE_PUBLICATION"
  )
  INSTALL_EXPECTED_RECONCILIATION_ARGV_SHA256=$(
    /usr/bin/jq --join-output '.reconciliation_argv[] | . + "\u0000"' \
      "$INSTALL_EFFECTIVE_PUBLICATION" \
      | /usr/bin/sha256sum | /usr/bin/cut -d' ' -f1
  )
  INSTALL_RECONCILIATION_ARGV_STATUS=0
  install_select_reusable_capture INSTALL_RECONCILIATION_ARGV_NUL || :
  INSTALL_RECONCILIATION_ARGV_NUL=$INSTALL_RECONCILIATION_ARGV_NUL_NEXT
  if install_capture_stdout "$INSTALL_RECONCILIATION_ARGV_NUL" \
    /usr/bin/jq --join-output '.reconciliation_argv[] | . + "\u0000"' \
      "$INSTALL_EFFECTIVE_PUBLICATION"
  then
    :
  else
    INSTALL_RECONCILIATION_ARGV_STATUS=$?
  fi

  INSTALL_RECONCILIATION_ARGV_VERIFIED=false
  if [[ $INSTALL_RECONCILIATION_ARGV_STATUS -eq 0 \
    && -s $INSTALL_RECONCILIATION_ARGV_NUL ]]
  then
    install_require_retained_capture "$INSTALL_RECONCILIATION_ARGV_NUL"
    if install_load_exact_reconciliation_argv \
      "$INSTALL_RECONCILIATION_ARGV_NUL" \
      "$INSTALL_EXPECTED_RECONCILIATION_ARGV_SHA256" \
      "$INSTALL_EXPECTED_RECONCILIATION_ARGV_COUNT"
    then
      INSTALL_RECONCILIATION_ARGV_VERIFIED=true
    fi
  fi

  if [[ $INSTALL_RECONCILIATION_ARGV_VERIFIED == true ]]; then
    INSTALL_RECONCILIATION_STATUS=0
    install_select_reusable_capture INSTALL_RECONCILIATION || :
    INSTALL_RECONCILIATION=$INSTALL_RECONCILIATION_NEXT
    install_assert_toolchain
    if install_capture_stdout "$INSTALL_RECONCILIATION" \
      "${INSTALL_RECONCILIATION_ARGV[@]}"
    then
      :
    else
      INSTALL_RECONCILIATION_STATUS=$?
    fi

    if [[ $INSTALL_RECONCILIATION_STATUS -eq 0 \
      && -s $INSTALL_RECONCILIATION ]] \
      && /usr/bin/jq --exit-status \
        --arg gate "$S22_INSTALL_GATE_ID" \
        --arg attempt "$S22_INSTALL_ATTEMPT_ID" \
        --arg fingerprint "$INSTALL_FINGERPRINT" \
        --arg revision "$INSTALL_REVISION" '
          ."state" == "completed"
          and ."repeat_privileged_launch" == false
          and ."rollback_outcome" == null
          and ."receipt"."state" == "postcommit_verified"
          and ."receipt"."action_type" ==
            "host.s22_measured_broker_install"
          and ."receipt"."approval_fingerprint" == $fingerprint
          and ."receipt"."authorization"."approval_gate_id" == $gate
          and ."receipt"."authorization"."approval_attempt_id" == $attempt
          and ."receipt"."authorization"."request_fingerprint" == $fingerprint
          and ."receipt"."authorization"."approval_revision" == $revision
          and ."receipt"."authorization"."execution_authorized" == true
          and ."receipt"."production_deploy" == false
        ' "$INSTALL_RECONCILIATION" >/dev/null
    then
      INSTALL_RECONCILIATION_VERIFIED=true
    fi
  fi
fi
# END S22 INSTALL RECONSTRUCTION RECONCILIATION

The generated reconciliation vector is the preferred form because it embeds the approval’s exact receipt path and complete fixed authority descriptor. Its action subcommand is s22-measured-broker-install.ts reconcile; do not hand-build or weaken that vector. A completed reconciliation receipt with state postcommit_verified is the authoritative installation result. It checks the approved manifest and plan, all 16 ordered mappings, the complete rooted source/runtime closure, host namespace and mount preconditions, target-UID quiescence, seed metadata, installed digests and modes, setuid-last activation, durable rollback inventory, and receipt-last publication.

Finish the same accepted revision only after reconciliation. Use succeeded only for the exact completed result above; otherwise use the accurately classified retryable_failure or terminal_failure outcome and include --error without repeating the privileged vector. Validate and reuse an existing finish capture:

# BEGIN S22 INSTALL FINISH CUSTODY
INSTALL_OUTCOME=terminal_failure
INSTALL_ERROR_ARGS=(--error "s22_install_reconciliation_not_completed")
if [[ $INSTALL_RECONCILIATION_VERIFIED == true ]]; then
  INSTALL_OUTCOME=succeeded
  INSTALL_ERROR_ARGS=()
fi

INSTALL_FINISH_STATUS=0
INSTALL_FINISH_RESPONSE_BASE=$INSTALL_FINISH_RESPONSE
INSTALL_FINISH_CAPTURE_VALID=false
if install_select_reusable_capture INSTALL_FINISH_RESPONSE; then
  :
else
  if install_capture_stdout "$INSTALL_FINISH_RESPONSE" \
    run_s22_install_chorus_cli approvals execution finish \
    --attempt-id "$S22_INSTALL_ATTEMPT_ID" \
    --approval-response "$INSTALL_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INSTALL_FINGERPRINT" \
    --revision "$INSTALL_REVISION" \
    --outcome "$INSTALL_OUTCOME" \
    "${INSTALL_ERROR_ARGS[@]}" \
    --profile inu --json
  then
    :
  else
    INSTALL_FINISH_STATUS=$?
  fi
fi
if [[ -s $INSTALL_FINISH_RESPONSE ]] \
  && INSTALL_FINISH_STATE=$(
    install_finish_state_from_capture \
      "$INSTALL_FINISH_RESPONSE" \
      "$S22_INSTALL_GATE_ID" \
      "$S22_INSTALL_ATTEMPT_ID" \
      "$INSTALL_FINGERPRINT" \
      "$INSTALL_REVISION"
  )
then
  INSTALL_FINISH_CAPTURE_VALID=true
fi

# A nonempty malformed or stale capture is immutable evidence, not a permanent
# poison pill. Recompute the first absent retry path from the canonical base and
# make one idempotent finish observation there.
if [[ $INSTALL_FINISH_CAPTURE_VALID == false ]]; then
  INSTALL_FINISH_RESPONSE=$INSTALL_FINISH_RESPONSE_BASE
  install_select_reusable_capture INSTALL_FINISH_RESPONSE || :
  INSTALL_FINISH_RESPONSE=$INSTALL_FINISH_RESPONSE_NEXT
  INSTALL_FINISH_STATUS=0
  if install_capture_stdout "$INSTALL_FINISH_RESPONSE" \
    run_s22_install_chorus_cli approvals execution finish \
    --attempt-id "$S22_INSTALL_ATTEMPT_ID" \
    --approval-response "$INSTALL_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INSTALL_FINGERPRINT" \
    --revision "$INSTALL_REVISION" \
    --outcome "$INSTALL_OUTCOME" \
    "${INSTALL_ERROR_ARGS[@]}" \
    --profile inu --json
  then
    :
  else
    INSTALL_FINISH_STATUS=$?
  fi
  if [[ -s $INSTALL_FINISH_RESPONSE ]] \
    && INSTALL_FINISH_STATE=$(
      install_finish_state_from_capture \
        "$INSTALL_FINISH_RESPONSE" \
        "$S22_INSTALL_GATE_ID" \
        "$S22_INSTALL_ATTEMPT_ID" \
        "$INSTALL_FINGERPRINT" \
        "$INSTALL_REVISION"
    )
  then
    INSTALL_FINISH_CAPTURE_VALID=true
  fi
fi
test "$INSTALL_FINISH_CAPTURE_VALID" = true
install_require_retained_capture "$INSTALL_FINISH_RESPONSE"
case "$INSTALL_FINISH_STATE" in
  succeeded) ;;
  failed|abandoned)
    INSTALL_FINISH_ERROR=$(
      /usr/bin/jq --exit-status --raw-output \
        '."attempt"."last_error"' "$INSTALL_FINISH_RESPONSE"
    )
    /usr/bin/printf \
      'retained install attempt is terminal: %s (%s)\n' \
      "$INSTALL_FINISH_STATE" "$INSTALL_FINISH_ERROR" >&2
    exit 1
    ;;
  *) exit 1 ;;
esac
test "$INSTALL_RECONCILIATION_VERIFIED" = true
test "$INSTALL_FINISH_STATE" = succeeded
# END S22 INSTALL FINISH CUSTODY

Invoke only through the separately approved measured action

The installation approval authorizes installation only. It never authorizes an invocation. One invocation is a new high-risk action whose type is exactly host.s22_measured_broker_invocation; its allowed result is one local measured broker invocation and immutable evidence, with no deployment, service start, traffic, or external network access. Never execute the installed setuid launcher directly. Never invoke the action tool’s root-execute subcommand directly. The only privileged command an operator may execute is the exact privileged_argv emitted after this separate approval is begun.

Use the completed install reconciliation as the installation result. Derive both the installed receipt path and expected native publication from the completed reconciliation and its exact install approval; neither is a caller-selected invocation input. The invocation action tool revalidates their mutual commitment before it writes an approval:

Run the marked custody prologue in a new Bash process on the first attempt and again after every reboot, shell loss, or operator handoff. It establishes its own strict shell and umask; it does not inherit either from the install section. On recovery, reuse the exact same state parent, state directory, source closure, CLI profile home, nonce, gate, and stable attempt. The prologue only reopens and validates already captured evidence. It never recreates a gate, consumes a fresh approval capability, repeats launch-start, or dispatches a privileged vector. If launch-start already exists, recovery is reconciliation-only.

# BEGIN S22 INVOCATION REBOOT RESUME CUSTODY
set -Eeuo pipefail
shopt -s inherit_errexit
umask 077
export LANG=C LC_ALL=C TZ=UTC

: "${S22_PINNED_BUN:?absolute pinned Bun path}"
: "${S22_PINNED_BUN_SHA256:?reviewed pinned Bun digest}"
: "${S22_INVOCATION_NONCE:?fresh lowercase SHA-256 invocation nonce}"
: "${S22_INVOCATION_ACTION_TOOL:?absolute pinned invocation action-tool path}"
: "${S22_INVOCATION_EXECUTOR:?absolute pinned invocation root executor path}"
: "${S22_APPROVAL_BEGIN_VERIFIER:?absolute pinned begin verifier path}"
: "${S22_APPROVAL_BEGIN_KEYS:?one or two comma-separated pinned public-key paths}"
: "${S22_INVOCATION_STATE_PARENT:?canonical owner-only mode-0700 state parent}"
: "${S22_INVOCATION_STATE:?new or retained private invocation state directory}"
: "${S22_CHORUS_CLI_SOURCE_ROOT:?reviewed absolute root-owned pinned CLI source closure}"
: "${S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256:?reviewed CLI source-closure digest}"
: "${S22_CHORUS_CLI_ENTRYPOINT_SHA256:?reviewed CLI entrypoint digest}"
: "${S22_CHORUS_CLI_HOME:?canonical owner-only reviewed CLI profile home}"
: "${S22_CHORUS_CLI_CONFIG_SHA256:?reviewed owner-only CLI profile digest}"
: "${INSTALL_APPROVAL:?retained canonical install approval path}"
: "${INSTALL_RECONCILIATION:?retained completed install reconciliation path}"
: "${APPROVER_IDENTITY:?identity allowed to approve this one invocation}"

INVOCATION_OPERATOR_UID=$(/usr/bin/id -u)
INVOCATION_OPERATOR_GID=$(/usr/bin/id -g)
test "$INVOCATION_OPERATOR_UID" -ne 0

invocation_assert_ancestor_custody() {
  local custody_path=$1
  local custody_fact custody_resolved_fact
  local custody_kind custody_mode custody_uid custody_gid custody_nlink
  while :; do
    [[ $custody_path == /* ]]
    test ! -L "$custody_path"
    test "$(/usr/bin/realpath -e -- "$custody_path")" = "$custody_path"
    # GNU stat without -L is the lstat check; -L must report the same inode facts.
    custody_fact=$(/usr/bin/stat -c '%F %a %u %g %h' -- "$custody_path")
    custody_resolved_fact=$(
      /usr/bin/stat -Lc '%F %a %u %g %h' -- "$custody_path"
    )
    test "$custody_fact" = "$custody_resolved_fact"
    read -r custody_kind custody_mode custody_uid custody_gid custody_nlink \
      <<<"$custody_fact"
    test "$custody_kind" = directory
    [[ $custody_uid == 0 || $custody_uid == "$INVOCATION_OPERATOR_UID" ]]
    if [[ $custody_uid == 0 ]]; then
      test "$custody_gid" = 0
    else
      test "$custody_gid" = "$INVOCATION_OPERATOR_GID"
    fi
    (( (8#$custody_mode & 8#022) == 0 ))
    test "$custody_nlink" -ge 2
    [[ $custody_path == / ]] && break
    custody_path=$(/usr/bin/dirname -- "$custody_path")
  done
}

invocation_assert_owner_directory() {
  local custody_path=$1
  test ! -L "$custody_path"
  test "$(/usr/bin/realpath -e -- "$custody_path")" = "$custody_path"
  test "$(/usr/bin/stat -c '%F %a %u %g' -- "$custody_path")" = \
    "directory 700 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID"
  test "$(/usr/bin/stat -Lc '%a %u %g' -- "$custody_path")" = \
    "700 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID"
  test "$(/usr/bin/stat -c '%h' -- "$custody_path")" -ge 2
}

invocation_assert_new_capture_path() {
  local capture_path=$1
  [[ $capture_path == "$S22_INVOCATION_STATE/"* ]]
  test "$(/usr/bin/dirname -- "$capture_path")" = "$S22_INVOCATION_STATE"
  test ! -e "$capture_path" -a ! -L "$capture_path"
}

invocation_assert_capture_file() {
  local capture_path=$1
  [[ $capture_path == "$S22_INVOCATION_STATE/"* ]]
  test "$(/usr/bin/dirname -- "$capture_path")" = "$S22_INVOCATION_STATE"
  test -f "$capture_path" -a ! -L "$capture_path"
  test "$(/usr/bin/realpath -e -- "$capture_path")" = "$capture_path"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- "$capture_path")" = \
    "regular file 600 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$capture_path")" = \
    "regular file 600 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID 1"
}

invocation_require_retained_capture() {
  local capture_path=$1
  invocation_assert_capture_file "$capture_path"
  test -s "$capture_path"
}

invocation_capture_stdout() {
  local capture_path=$1
  shift
  local capture_status=0
  invocation_assert_new_capture_path "$capture_path"
  ( set -o noclobber
    "$@" >"$capture_path"
  ) || capture_status=$?
  invocation_assert_capture_file "$capture_path"
  return "$capture_status"
}

invocation_select_reusable_capture() {
  local capture_variable=$1
  local -n capture_reference=$capture_variable
  local capture_base=$capture_reference
  local capture_candidate=$capture_base
  local capture_selected=
  local capture_index=0
  while [[ -e $capture_candidate || -L $capture_candidate ]]; do
    invocation_assert_capture_file "$capture_candidate"
    if [[ -s $capture_candidate ]]; then
      capture_selected=$capture_candidate
    fi
    capture_index=$((capture_index + 1))
    printf -v capture_candidate '%s.retry-%06d' \
      "$capture_base" "$capture_index"
  done
  printf -v "${capture_variable}_NEXT" '%s' "$capture_candidate"
  if [[ -n $capture_selected ]]; then
    capture_reference=$capture_selected
    return 0
  fi
  capture_reference=$capture_candidate
  return 1
}

invocation_load_exact_reconciliation_argv() {
  local capture_path=$1
  local expected_sha256=$2
  local expected_count=$3
  local observed_sha256
  local -a observed_argv=()
  if ! observed_sha256=$(
    /usr/bin/sha256sum -- "$capture_path" | /usr/bin/cut -d' ' -f1
  ); then
    return 1
  fi
  [[ $observed_sha256 == "$expected_sha256" ]] || return 1
  mapfile -d '' -t observed_argv <"$capture_path" || return 1
  [[ ${#observed_argv[@]} -eq $expected_count ]] || return 1
  INVOCATION_RECONCILIATION_ARGV=("${observed_argv[@]}")
}

invocation_finish_state_from_capture() {
  local capture_path=$1
  local gate_id=$2
  local attempt_id=$3
  local fingerprint=$4
  local revision=$5
  /usr/bin/jq --exit-status --raw-output \
    --arg gate "$gate_id" \
    --arg attempt "$attempt_id" \
    --arg fingerprint "$fingerprint" \
    --arg revision "$revision" '
      select(
        (."status" == "finished" or ."status" == "idempotent")
        and ."execution_authorized" == false
        and ."attempt"."gate_id" == $gate
        and ."attempt"."attempt_id" == $attempt
        and ."attempt"."request_fingerprint" == $fingerprint
        and (
          .attempt.state == "succeeded"
          or .attempt.state == "failed"
          or .attempt.state == "abandoned"
        )
        and (."attempt"."completed_at" | type == "string" and length > 0)
        and (."attempt"."revision" | type == "number" and floor == .)
        and ."attempt"."revision" == (($revision | tonumber) + 1)
        and (
          if .attempt.state == "succeeded"
          then (."attempt"."last_error" // null) == null
          else (
            ."attempt"."last_error" | type == "string"
            and length >= 1 and length <= 128
          )
          end
        )
      )
      | .attempt.state
    ' "$capture_path"
}

invocation_assert_root_ancestors() {
  local source_path=$1
  local source_fact source_kind source_mode source_uid source_gid source_nlink
  while :; do
    test ! -L "$source_path"
    test "$(/usr/bin/realpath -e -- "$source_path")" = "$source_path"
    source_fact=$(/usr/bin/stat -c '%F %a %u %g %h' -- "$source_path")
    test "$source_fact" = \
      "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$source_path")"
    read -r source_kind source_mode source_uid source_gid source_nlink \
      <<<"$source_fact"
    test "$source_kind" = directory
    test "$source_uid $source_gid" = "0 0"
    (( (8#$source_mode & 8#022) == 0 ))
    test "$source_nlink" -ge 2
    [[ $source_path == / ]] && break
    source_path=$(/usr/bin/dirname -- "$source_path")
  done
}

invocation_cli_source_closure_stream() {
  local source_path source_relative source_fact
  local source_mode source_uid source_gid source_nlink source_sha256
  while IFS= read -r -d '' source_path; do
    test ! -L "$source_path"
    test "$(/usr/bin/realpath -e -- "$source_path")" = "$source_path"
    source_fact=$(/usr/bin/stat -c '%a %u %g %h' -- "$source_path")
    test "$source_fact" = \
      "$(/usr/bin/stat -Lc '%a %u %g %h' -- "$source_path")"
    read -r source_mode source_uid source_gid source_nlink <<<"$source_fact"
    test "$source_uid $source_gid" = "0 0"
    (( (8#$source_mode & 8#022) == 0 ))
    source_relative=${source_path#"$S22_CHORUS_CLI_SOURCE_ROOT"/}
    test "$source_relative" != "$source_path"
    if [[ -d $source_path ]]; then
      test "$source_nlink" -ge 2
      /usr/bin/printf 'directory\0%s\0%s\0' \
        "$source_relative" "$source_fact"
    elif [[ -f $source_path ]]; then
      test "$source_nlink" = 1
      source_sha256=$(
        /usr/bin/sha256sum -- "$source_path" | /usr/bin/cut -d' ' -f1
      )
      /usr/bin/printf 'file\0%s\0%s\0%s\0' \
        "$source_relative" "$source_fact" "$source_sha256"
    else
      return 1
    fi
  done < <(
    /usr/bin/find -P "$S22_CHORUS_CLI_SOURCE_ROOT" -mindepth 1 -print0 \
      | LC_ALL=C /usr/bin/sort -z
  )
}

test "$(/usr/bin/dirname -- "$S22_INVOCATION_STATE")" = \
  "$S22_INVOCATION_STATE_PARENT"
invocation_assert_ancestor_custody "$S22_INVOCATION_STATE_PARENT"
invocation_assert_owner_directory "$S22_INVOCATION_STATE_PARENT"
INVOCATION_STATE_RETAINED=false
INVOCATION_RECOVERY_MODE=false
INVOCATION_PREFENCE_MODE=false
if [[ -e $S22_INVOCATION_STATE && ! -L $S22_INVOCATION_STATE ]]; then
  INVOCATION_STATE_RETAINED=true
else
  test ! -e "$S22_INVOCATION_STATE" -a ! -L "$S22_INVOCATION_STATE"
  /usr/bin/mkdir -m 0700 -- "$S22_INVOCATION_STATE"
fi
invocation_assert_ancestor_custody "$S22_INVOCATION_STATE"
invocation_assert_owner_directory "$S22_INVOCATION_STATE"
if [[ $INVOCATION_STATE_RETAINED == true ]]; then
  if [[ -s $S22_INVOCATION_STATE/launch-start.json ]]; then
    invocation_require_retained_capture "$S22_INVOCATION_STATE/launch-start.json"
    INVOCATION_RECOVERY_MODE=true
  else
    if [[ -e $S22_INVOCATION_STATE/launch-start.json \
      || -L $S22_INVOCATION_STATE/launch-start.json ]]
    then
      invocation_assert_capture_file "$S22_INVOCATION_STATE/launch-start.json"
    fi
    INVOCATION_PREFENCE_MODE=true
  fi
fi

invocation_assert_root_ancestors "$(/usr/bin/dirname -- "$S22_PINNED_BUN")"
test "$(/usr/bin/realpath -e -- "$S22_PINNED_BUN")" = "$S22_PINNED_BUN"
test -f "$S22_PINNED_BUN" -a ! -L "$S22_PINNED_BUN"
INVOCATION_BUN_FACT=$(
  /usr/bin/stat -c '%F %a %u %g %h' -- "$S22_PINNED_BUN"
)
test "$INVOCATION_BUN_FACT" = \
  "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$S22_PINNED_BUN")"
[[ $INVOCATION_BUN_FACT == "regular file 555 0 0 1" \
  || $INVOCATION_BUN_FACT == "regular file 755 0 0 1" ]]
test "$(/usr/bin/sha256sum -- "$S22_PINNED_BUN" | /usr/bin/cut -d' ' -f1)" = \
  "$S22_PINNED_BUN_SHA256"

test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_SOURCE_ROOT")" = \
  "$S22_CHORUS_CLI_SOURCE_ROOT"
test "$(/usr/bin/stat -c '%F %a %u %g' -- \
  "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
test "$(/usr/bin/stat -Lc '%F %a %u %g' -- \
  "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
invocation_assert_root_ancestors "$S22_CHORUS_CLI_SOURCE_ROOT"
invocation_observed_source_closure_sha256=$(
  invocation_cli_source_closure_stream | /usr/bin/sha256sum \
    | /usr/bin/cut -d' ' -f1
)
test "$invocation_observed_source_closure_sha256" = \
  "$S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256"
test "$S22_INVOCATION_ACTION_TOOL" = \
  "$S22_CHORUS_CLI_SOURCE_ROOT/scripts/s22-measured-broker-invocation.ts"
test "$(/usr/bin/realpath -e -- "$S22_INVOCATION_ACTION_TOOL")" = \
  "$S22_INVOCATION_ACTION_TOOL"
test -f "$S22_INVOCATION_ACTION_TOOL" -a ! -L "$S22_INVOCATION_ACTION_TOOL"
test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
  "$S22_INVOCATION_ACTION_TOOL")" = "regular file 444 0 0 1"
test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
  "$S22_INVOCATION_ACTION_TOOL")" = "regular file 444 0 0 1"
readonly S22_CHORUS_CLI_ENTRYPOINT="$S22_CHORUS_CLI_SOURCE_ROOT/packages/cli/src/index.ts"
test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_ENTRYPOINT")" = \
  "$S22_CHORUS_CLI_ENTRYPOINT"
test -f "$S22_CHORUS_CLI_ENTRYPOINT" -a ! -L "$S22_CHORUS_CLI_ENTRYPOINT"
test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
  "$S22_CHORUS_CLI_ENTRYPOINT")" = "regular file 444 0 0 1"
test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
  "$S22_CHORUS_CLI_ENTRYPOINT")" = "regular file 444 0 0 1"
test "$(/usr/bin/sha256sum -- \
  "$S22_CHORUS_CLI_ENTRYPOINT" | /usr/bin/cut -d' ' -f1)" = \
  "$S22_CHORUS_CLI_ENTRYPOINT_SHA256"

invocation_assert_ancestor_custody "$S22_CHORUS_CLI_HOME"
invocation_assert_owner_directory "$S22_CHORUS_CLI_HOME"
invocation_assert_owner_directory "$S22_CHORUS_CLI_HOME/.chorus"
S22_CHORUS_CLI_CONFIG="$S22_CHORUS_CLI_HOME/.chorus/config.yaml"
invocation_assert_cli_config() {
  test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_CONFIG")" = \
    "$S22_CHORUS_CLI_CONFIG"
  test -f "$S22_CHORUS_CLI_CONFIG" -a ! -L "$S22_CHORUS_CLI_CONFIG"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_CHORUS_CLI_CONFIG")" = \
    "regular file 600 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_CHORUS_CLI_CONFIG")" = \
    "regular file 600 $INVOCATION_OPERATOR_UID $INVOCATION_OPERATOR_GID 1"
  test "$(/usr/bin/sha256sum -- \
    "$S22_CHORUS_CLI_CONFIG" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_CHORUS_CLI_CONFIG_SHA256"
}

invocation_assert_toolchain() {
  local observed_bun_fact observed_source_closure_sha256
  invocation_assert_root_ancestors \
    "$(/usr/bin/dirname -- "$S22_PINNED_BUN")"
  test "$(/usr/bin/realpath -e -- "$S22_PINNED_BUN")" = "$S22_PINNED_BUN"
  test -f "$S22_PINNED_BUN" -a ! -L "$S22_PINNED_BUN"
  observed_bun_fact=$(
    /usr/bin/stat -c '%F %a %u %g %h' -- "$S22_PINNED_BUN"
  )
  test "$observed_bun_fact" = \
    "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- "$S22_PINNED_BUN")"
  [[ $observed_bun_fact == "regular file 555 0 0 1" \
    || $observed_bun_fact == "regular file 755 0 0 1" ]]
  test "$(/usr/bin/sha256sum -- \
    "$S22_PINNED_BUN" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_PINNED_BUN_SHA256"

  test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_SOURCE_ROOT")" = \
    "$S22_CHORUS_CLI_SOURCE_ROOT"
  test "$(/usr/bin/stat -c '%F %a %u %g' -- \
    "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
  test "$(/usr/bin/stat -Lc '%F %a %u %g' -- \
    "$S22_CHORUS_CLI_SOURCE_ROOT")" = "directory 555 0 0"
  invocation_assert_root_ancestors "$S22_CHORUS_CLI_SOURCE_ROOT"
  observed_source_closure_sha256=$(
    invocation_cli_source_closure_stream | /usr/bin/sha256sum \
      | /usr/bin/cut -d' ' -f1
  )
  test "$observed_source_closure_sha256" = \
    "$S22_CHORUS_CLI_SOURCE_CLOSURE_SHA256"

  test "$S22_INVOCATION_ACTION_TOOL" = \
    "$S22_CHORUS_CLI_SOURCE_ROOT/scripts/s22-measured-broker-invocation.ts"
  test "$(/usr/bin/realpath -e -- "$S22_INVOCATION_ACTION_TOOL")" = \
    "$S22_INVOCATION_ACTION_TOOL"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_INVOCATION_ACTION_TOOL")" = "regular file 444 0 0 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_INVOCATION_ACTION_TOOL")" = "regular file 444 0 0 1"
  test "$(/usr/bin/realpath -e -- "$S22_CHORUS_CLI_ENTRYPOINT")" = \
    "$S22_CHORUS_CLI_ENTRYPOINT"
  test "$(/usr/bin/stat -c '%F %a %u %g %h' -- \
    "$S22_CHORUS_CLI_ENTRYPOINT")" = "regular file 444 0 0 1"
  test "$(/usr/bin/stat -Lc '%F %a %u %g %h' -- \
    "$S22_CHORUS_CLI_ENTRYPOINT")" = "regular file 444 0 0 1"
  test "$(/usr/bin/sha256sum -- \
    "$S22_CHORUS_CLI_ENTRYPOINT" | /usr/bin/cut -d' ' -f1)" = \
    "$S22_CHORUS_CLI_ENTRYPOINT_SHA256"

  invocation_assert_ancestor_custody "$S22_CHORUS_CLI_HOME"
  invocation_assert_owner_directory "$S22_CHORUS_CLI_HOME"
  invocation_assert_owner_directory "$S22_CHORUS_CLI_HOME/.chorus"
  invocation_assert_cli_config
  test ! -e /bunfig.toml -a ! -L /bunfig.toml
}
invocation_assert_toolchain

run_s22_invocation_chorus_cli() (
  invocation_assert_toolchain
  cd /
  /usr/bin/env -i \
    PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    HOME="$S22_CHORUS_CLI_HOME" \
    "$S22_PINNED_BUN" --no-env-file run \
      "$S22_CHORUS_CLI_ENTRYPOINT" "$@"
)

run_s22_invocation_action_tool() (
  invocation_assert_toolchain
  cd /
  /usr/bin/env -i \
    PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    HOME="$S22_CHORUS_CLI_HOME" \
    "$S22_PINNED_BUN" --no-env-file run \
      "$S22_INVOCATION_ACTION_TOOL" "$@"
)

invocation_verify_prefence_attestation() (
  local action_type=$1
  local approval_path=$2
  local attestation_path=$3
  cd /
  /usr/bin/env -i PATH=/usr/bin:/bin LANG=C LC_ALL=C TZ=UTC \
    S22_PREFENCE_ACTION_TYPE="$action_type" \
    S22_PREFENCE_APPROVAL="$approval_path" \
    S22_PREFENCE_ATTESTATION="$attestation_path" \
    S22_PREFENCE_EXPECTED_VERIFIER="$S22_APPROVAL_BEGIN_VERIFIER" \
    S22_PREFENCE_EXPECTED_KEYS="$S22_APPROVAL_BEGIN_KEYS" \
    "$S22_PINNED_BUN" --no-env-file -e '
const {
  closeSync,
  constants,
  fstatSync,
  lstatSync,
  openSync,
  readSync,
  realpathSync,
} = require("node:fs");
const { createHash } = require("node:crypto");
const { spawnSync } = require("node:child_process");
const { dirname, resolve } = require("node:path");
const env = process.env;
const held = [];
let rejection = null;
const fail = (message) => {
  throw new Error(`invocation pre-fence attestation rejected: ${message}`);
};
const requireExact = (condition, message) => {
  if (!condition) fail(message);
};
const canonicalPath = (value, label) => {
  requireExact(
    typeof value === "string" &&
      value.length >= 1 &&
      value.length <= 4095 &&
      value.startsWith("/") &&
      !value.includes("\0") &&
      resolve(value) === value,
    `${label} path is not canonical`,
  );
  return value;
};
const modeOf = (status) =>
  Number(status.mode & 0o7777n).toString(8).padStart(4, "0");
const sameIdentity = (left, right) =>
  left.dev === right.dev && left.ino === right.ino;
const readHeld = (fd, size, label) => {
  const bytes = Buffer.alloc(size);
  let offset = 0;
  while (offset < size) {
    const count = readSync(fd, bytes, offset, size - offset, offset);
    requireExact(count > 0, `${label} ended before its retained size`);
    offset += count;
  }
  return bytes;
};
const openRegular = (pathValue, maximumBytes, label) => {
  const path = canonicalPath(pathValue, label);
  requireExact(realpathSync(path) === path, `${label} path moved`);
  const visible = lstatSync(path, { bigint: true });
  requireExact(visible.isFile(), `${label} is not a regular file`);
  const fd = openSync(
    path,
    constants.O_RDONLY | constants.O_CLOEXEC | constants.O_NOFOLLOW,
  );
  held.push(fd);
  const status = fstatSync(fd, { bigint: true });
  requireExact(
    status.isFile() && sameIdentity(visible, status),
    `${label} changed while it was opened`,
  );
  const size = Number(status.size);
  requireExact(
    Number.isSafeInteger(size) && size >= 1 && size <= maximumBytes,
    `${label} size is outside its bound`,
  );
  return { bytes: readHeld(fd, size, label), fd, path, size, status };
};
const exactFileFact = (value, label, maximumBytes) => {
  requireExact(
    value !== null && typeof value === "object" && !Array.isArray(value),
    `${label} fact is not an object`,
  );
  const expectedKeys = [
    "device", "gid", "inode", "link_count", "mode",
    "path", "sha256", "size_bytes", "uid",
  ];
  requireExact(
    JSON.stringify(Object.keys(value).sort()) ===
      JSON.stringify(expectedKeys),
    `${label} fact shape differs`,
  );
  requireExact(
    typeof value.sha256 === "string" &&
      /^[0-9a-f]{64}$/.test(value.sha256) &&
      Number.isSafeInteger(value.size_bytes) &&
      value.size_bytes >= 1 &&
      value.size_bytes <= maximumBytes &&
      typeof value.mode === "string" &&
      /^[0-7]{4}$/.test(value.mode) &&
      Number.isSafeInteger(value.uid) &&
      Number.isSafeInteger(value.gid) &&
      value.link_count === 1 &&
      typeof value.device === "string" &&
      /^[0-9]+$/.test(value.device) &&
      typeof value.inode === "string" &&
      /^[0-9]+$/.test(value.inode),
    `${label} fact fields differ`,
  );
  canonicalPath(value.path, label);
  return value;
};
const measureApprovedFile = (fact, label, maximumBytes) => {
  const observed = openRegular(fact.path, maximumBytes, label);
  requireExact(
    observed.size === fact.size_bytes &&
      modeOf(observed.status) === fact.mode &&
      Number(observed.status.uid) === fact.uid &&
      Number(observed.status.gid) === fact.gid &&
      Number(observed.status.nlink) === fact.link_count &&
      observed.status.dev.toString() === fact.device &&
      observed.status.ino.toString() === fact.inode &&
      createHash("sha256").update(observed.bytes).digest("hex") ===
        fact.sha256,
    `${label} differs from the retained approval`,
  );
  return observed;
};
const exactDirectoryFact = (value, label) => {
  requireExact(
    value !== null && typeof value === "object" && !Array.isArray(value),
    `${label} fact is not an object`,
  );
  const expectedKeys = ["device", "gid", "inode", "mode", "path", "uid"];
  requireExact(
    JSON.stringify(Object.keys(value).sort()) ===
      JSON.stringify(expectedKeys),
    `${label} fact shape differs`,
  );
  requireExact(
    typeof value.mode === "string" &&
      /^[0-7]{4}$/.test(value.mode) &&
      Number.isSafeInteger(value.uid) &&
      Number.isSafeInteger(value.gid) &&
      typeof value.device === "string" &&
      /^[0-9]+$/.test(value.device) &&
      typeof value.inode === "string" &&
      /^[0-9]+$/.test(value.inode),
    `${label} fact fields differ`,
  );
  canonicalPath(value.path, label);
  return value;
};
const holdApprovedDirectory = (fact, label) => {
  const path = canonicalPath(fact.path, label);
  requireExact(realpathSync(path) === path, `${label} path moved`);
  const visible = lstatSync(path, { bigint: true });
  requireExact(visible.isDirectory(), `${label} is not a directory`);
  const fd = openSync(
    path,
    constants.O_RDONLY | constants.O_DIRECTORY |
      constants.O_CLOEXEC | constants.O_NOFOLLOW,
  );
  held.push(fd);
  const status = fstatSync(fd, { bigint: true });
  requireExact(
    status.isDirectory() &&
      sameIdentity(visible, status) &&
      modeOf(status) === fact.mode &&
      Number(status.uid) === fact.uid &&
      Number(status.gid) === fact.gid &&
      status.dev.toString() === fact.device &&
      status.ino.toString() === fact.inode &&
      fact.uid === 0 &&
      fact.gid === 0 &&
      (Number.parseInt(fact.mode, 8) & 0o022) === 0,
    `${label} differs from the retained approval`,
  );
};
const directoryChain = (filePath) => {
  const chain = [];
  let current = dirname(filePath);
  while (true) {
    chain.push(current);
    if (current === "/") break;
    current = dirname(current);
  }
  return chain;
};
try {
  const approval = openRegular(
    env.S22_PREFENCE_APPROVAL,
    8 * 1024 * 1024,
    "retained approval",
  );
  const attestation = openRegular(
    env.S22_PREFENCE_ATTESTATION,
    1024 * 1024,
    "retained approval-begin attestation",
  );
  let parsed;
  try {
    parsed = JSON.parse(approval.bytes.toString("utf8"));
  } catch {
    fail("retained approval is not JSON");
  }
  requireExact(
    parsed !== null && typeof parsed === "object" &&
      parsed.action_type === env.S22_PREFENCE_ACTION_TYPE &&
      parsed.authorities !== null &&
      typeof parsed.authorities === "object",
    "retained approval action or authority surface differs",
  );
  const verifierFact = exactFileFact(
    parsed.authorities.approval_begin_verifier,
    "approved verifier",
    64 * 1024 * 1024,
  );
  requireExact(
    Array.isArray(parsed.authorities.approval_begin_public_keys) &&
      parsed.authorities.approval_begin_public_keys.length >= 1 &&
      parsed.authorities.approval_begin_public_keys.length <= 2,
    "approved public-key cardinality differs",
  );
  const keyFacts = parsed.authorities.approval_begin_public_keys.map(
    (value, index) =>
      exactFileFact(value, `approved public key ${index + 1}`, 1024 * 1024),
  );
  const approvedKeyPaths = keyFacts.map((fact) => fact.path);
  requireExact(
    verifierFact.path === env.S22_PREFENCE_EXPECTED_VERIFIER &&
      approvedKeyPaths.every((path) => !path.includes(",")) &&
      approvedKeyPaths.join(",") === env.S22_PREFENCE_EXPECTED_KEYS,
    "environment verifier or public-key paths differ from the retained approval",
  );
  requireExact(
    Array.isArray(parsed.authorities.root_ancestors) &&
      parsed.authorities.root_ancestors.length >= 1 &&
      parsed.authorities.root_ancestors.length <= 128,
    "approved ancestor cardinality differs",
  );
  const ancestorFacts = parsed.authorities.root_ancestors.map(
    (value, index) =>
      exactDirectoryFact(value, `approved ancestor ${index + 1}`),
  );
  const ancestorPaths = ancestorFacts.map((fact) => fact.path);
  requireExact(
    new Set(ancestorPaths).size === ancestorPaths.length &&
      JSON.stringify(ancestorPaths) ===
        JSON.stringify([...ancestorPaths].sort()),
    "approved ancestor closure is repeated or unordered",
  );
  const requiredAncestors = [
    verifierFact.path,
    ...approvedKeyPaths,
  ].flatMap(directoryChain);
  requireExact(
    requiredAncestors.every((path) => ancestorPaths.includes(path)),
    "approved ancestor closure does not cover verifier and keys",
  );
  ancestorFacts.forEach((fact, index) =>
    holdApprovedDirectory(fact, `approved ancestor ${index + 1}`)
  );
  const verifier = measureApprovedFile(
    verifierFact,
    "approved verifier",
    64 * 1024 * 1024,
  );
  const keys = keyFacts.map((fact, index) =>
    measureApprovedFile(
      fact,
      `approved public key ${index + 1}`,
      1024 * 1024,
    )
  );
  const identities = [approval, attestation, verifier, ...keys]
    .map(({ status }) => `${status.dev}:${status.ino}`);
  requireExact(
    new Set(identities).size === identities.length,
    "held verifier inputs alias",
  );
  const keyFds = keys.map((_, index) => 6 + index);
  const keyArgs = keyFds.flatMap((fd) => ["--key-fd", String(fd)]);
  const result = spawnSync(
    "/proc/self/fd/3",
    [
      "verify-v1",
      "--approval-fd", "4",
      "--attestation-fd", "5",
      "--action-type", env.S22_PREFENCE_ACTION_TYPE,
      ...keyArgs,
    ],
    {
      cwd: "/",
      env: {},
      encoding: "buffer",
      stdio: [
        "ignore", "pipe", "pipe",
        verifier.fd, approval.fd, attestation.fd,
        ...keys.map(({ fd }) => fd),
      ],
      timeout: 10000,
      killSignal: "SIGKILL",
      maxBuffer: 4096,
    },
  );
  requireExact(
    result.error === undefined &&
      result.status === 0 &&
      result.signal === null &&
      result.stdout?.byteLength === 0 &&
      result.stderr?.byteLength === 0,
    "held native verifier did not complete cleanly",
  );
} catch (error) {
  rejection = error;
} finally {
  for (const fd of held.reverse()) {
    try {
      closeSync(fd);
    } catch {}
  }
}
if (rejection !== null) {
  console.error(
    rejection instanceof Error ? rejection.message : String(rejection),
  );
  process.exitCode = 1;
}
'
)

invocation_prefence_gate_identity() {
  local retained fingerprint gate_id
  for retained in \
    "$INVOCATION_APPROVAL" \
    "$INVOCATION_APPROVAL_STDOUT" \
    "$INVOCATION_GATE_REQUEST" \
    "$INVOCATION_GATE_CREATE"
  do
    [[ -s $retained ]] || return 1
    invocation_require_retained_capture "$retained" || return 1
  done
  /usr/bin/cmp -- "$INVOCATION_APPROVAL" "$INVOCATION_APPROVAL_STDOUT" \
    || return 1
  /usr/bin/jq --exit-status \
    --arg nonce "$S22_INVOCATION_NONCE" '
      .schema_version == "chorus.s22-measured-broker-invocation-approval/1"
      and .action_type == "host.s22_measured_broker_invocation"
      and .invocation_nonce == $nonce
    ' "$INVOCATION_APPROVAL" >/dev/null || return 1
  fingerprint=$(
    run_s22_invocation_action_tool \
      approval-fingerprint --approval "$INVOCATION_APPROVAL"
  ) || return 1
  [[ $fingerprint =~ ^[0-9a-f]{64}$ ]] || return 1
  gate_id=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg fingerprint "$fingerprint" \
      --slurpfile approval "$INVOCATION_APPROVAL" '
        select(
          .action_type == "host.s22_measured_broker_invocation"
          and .action_fingerprint == $fingerprint
          and .action_payload == $approval[0]
        )
        | .id
      ' "$INVOCATION_GATE_CREATE"
  ) || return 1
  [[ $gate_id =~ ^approval_gate: ]] || return 1
  /usr/bin/printf '%s\t%s\n' "$gate_id" "$fingerprint"
}

invocation_require_canonical_rfc3339_milliseconds() {
  local timestamp=$1
  local roundtrip
  [[ $timestamp =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z$ ]] \
    || return 1
  roundtrip=$(
    /usr/bin/date --utc --date="$timestamp" '+%Y-%m-%dT%H:%M:%S.%3NZ'
  ) || return 1
  [[ $roundtrip == "$timestamp" ]]
}

invocation_token_expiry_has_elapsed() {
  local token_expires_at=$1
  local now
  invocation_require_canonical_rfc3339_milliseconds "$token_expires_at" \
    || return 1
  now=$(
    /usr/bin/date --utc '+%Y-%m-%dT%H:%M:%S.%3NZ'
  ) || return 1
  invocation_require_canonical_rfc3339_milliseconds "$now" || return 1
  [[ $now == "$token_expires_at" || $now > "$token_expires_at" ]]
}

invocation_capture_prefence_gate_observation() {
  local gate_id=$1
  local fingerprint=$2
  local observation_base=$INVOCATION_PREFENCE_GATE_OBSERVATION
  INVOCATION_PREFENCE_GATE_OBSERVATION=$observation_base
  invocation_select_reusable_capture \
    INVOCATION_PREFENCE_GATE_OBSERVATION || :
  INVOCATION_PREFENCE_GATE_OBSERVATION=\
"$INVOCATION_PREFENCE_GATE_OBSERVATION_NEXT"
  invocation_capture_stdout "$INVOCATION_PREFENCE_GATE_OBSERVATION" \
    run_s22_invocation_chorus_cli approvals get "$gate_id" \
    --profile inu --json || :
  invocation_require_retained_capture \
    "$INVOCATION_PREFENCE_GATE_OBSERVATION" || return 1
  /usr/bin/jq --exit-status \
    --arg gate "$gate_id" \
    --arg fingerprint "$fingerprint" \
    --slurpfile approval "$INVOCATION_APPROVAL" '
      .id == $gate
      and .action_type == "host.s22_measured_broker_invocation"
      and .action_fingerprint == $fingerprint
      and .action_payload == $approval[0]
      and (
        .status == "pending"
        or .status == "approved"
        or .status == "denied"
        or .status == "cancelled"
      )
    ' "$INVOCATION_PREFENCE_GATE_OBSERVATION" >/dev/null
}

invocation_prefence_finish_is_terminal_failure() {
  local response_path=$1
  local gate_id=$2
  local attempt_id=$3
  local fingerprint=$4
  local revision=$5
  local state
  state=$(
    invocation_finish_state_from_capture \
      "$response_path" "$gate_id" "$attempt_id" "$fingerprint" "$revision"
  ) || return 1
  [[ $state == failed || $state == abandoned ]] || return 1
  /usr/bin/jq --exit-status \
    '."attempt"."last_error" == "s22_invocation_prelaunch_interrupted"' \
    "$response_path" >/dev/null
}

invocation_close_prefence_attempt() {
  local gate_id=$1
  local attempt_id=$2
  local fingerprint=$3
  local revision=$4
  local response_base=$INVOCATION_PREFENCE_FINISH_RESPONSE
  local had_capture=false
  if invocation_select_reusable_capture INVOCATION_PREFENCE_FINISH_RESPONSE
  then
    had_capture=true
    if invocation_prefence_finish_is_terminal_failure \
      "$INVOCATION_PREFENCE_FINISH_RESPONSE" \
      "$gate_id" "$attempt_id" "$fingerprint" "$revision"
    then
      return 0
    fi
  fi
  if [[ $had_capture == true ]]; then
    INVOCATION_PREFENCE_FINISH_RESPONSE=$response_base
    invocation_select_reusable_capture \
      INVOCATION_PREFENCE_FINISH_RESPONSE || :
    INVOCATION_PREFENCE_FINISH_RESPONSE=\
"$INVOCATION_PREFENCE_FINISH_RESPONSE_NEXT"
  fi
  invocation_capture_stdout "$INVOCATION_PREFENCE_FINISH_RESPONSE" \
    run_s22_invocation_chorus_cli approvals execution finish \
    --attempt-id "$attempt_id" \
    --approval-response "$INVOCATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$fingerprint" \
    --revision "$revision" \
    --outcome terminal_failure \
    --error "s22_invocation_prelaunch_interrupted" \
    --profile inu --json || :
  invocation_prefence_finish_is_terminal_failure \
    "$INVOCATION_PREFENCE_FINISH_RESPONSE" \
    "$gate_id" "$attempt_id" "$fingerprint" "$revision"
}

invocation_recover_consumed_prefence_attempt() {
  local gate_id=$1
  local fingerprint=$2
  local attempt_id="s22-invocation-$S22_INVOCATION_NONCE"
  local begin_base=$INVOCATION_PREFENCE_BEGIN_OBSERVATION
  local attestation_base=$INVOCATION_PREFENCE_RESUME_ATTESTATION
  local begin_identity begin_status begin_revision begin_state
  local begin_attempt_state

  invocation_require_retained_capture \
    "$INVOCATION_APPROVAL_RESPONSE" || return 1
  /usr/bin/jq --exit-status \
    --arg gate "$gate_id" \
    --arg fingerprint "$fingerprint" '
      (.data // .gate // .) as $response
      | $response.id == $gate
      and $response.action_fingerprint == $fingerprint
      and (
        (.execution_token // .data.execution_token // .gate.execution_token)
        | if type == "object" then .token else . end
        | type == "string" and length >= 1 and length <= 512
      )
    ' "$INVOCATION_APPROVAL_RESPONSE" >/dev/null || return 1

  INVOCATION_PREFENCE_BEGIN_OBSERVATION=$begin_base
  invocation_select_reusable_capture \
    INVOCATION_PREFENCE_BEGIN_OBSERVATION || :
  INVOCATION_PREFENCE_BEGIN_OBSERVATION=\
"$INVOCATION_PREFENCE_BEGIN_OBSERVATION_NEXT"
  INVOCATION_PREFENCE_RESUME_ATTESTATION=$attestation_base
  invocation_select_reusable_capture \
    INVOCATION_PREFENCE_RESUME_ATTESTATION || :
  INVOCATION_PREFENCE_RESUME_ATTESTATION=\
"$INVOCATION_PREFENCE_RESUME_ATTESTATION_NEXT"

  begin_status=0
  if invocation_capture_stdout "$INVOCATION_PREFENCE_BEGIN_OBSERVATION" \
    run_s22_invocation_chorus_cli approvals execution begin \
    --attempt-id "$attempt_id" \
    --approval-response "$INVOCATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$fingerprint" \
    --attestation-output "$INVOCATION_PREFENCE_RESUME_ATTESTATION" \
    --profile inu --json
  then
    :
  else
    begin_status=$?
  fi
  invocation_require_retained_capture \
    "$INVOCATION_PREFENCE_BEGIN_OBSERVATION" || return 1
  begin_identity=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg gate "$gate_id" \
      --arg attempt "$attempt_id" \
      --arg fingerprint "$fingerprint" '
        select(
          .attempt.gate_id == $gate
          and .attempt.attempt_id == $attempt
          and .attempt.request_fingerprint == $fingerprint
          and (.attempt.revision | type == "number" and . >= 1 and floor == .)
          and (
            (
              .status == "observed_in_flight"
              and .execution_authorized == false
              and .attempt.state == "accepted"
            )
            or (
              .status == "observed_completed"
              and .execution_authorized == false
              and (
                .attempt.state == "failed"
                or .attempt.state == "abandoned"
              )
            )
            or (
              .status == "resumed"
              and .execution_authorized == true
              and .attempt.state == "accepted"
              and .attestation.payload.gate_id == $gate
              and .attestation.payload.attempt == .attempt
              and .attestation.payload.execution_authorized == true
              and (.attestation.signature_base64url |
                type == "string" and length > 0)
            )
          )
        )
        | [.status, (.attempt.revision | tostring), .attempt.state]
        | @tsv
      ' "$INVOCATION_PREFENCE_BEGIN_OBSERVATION"
  ) || return 1
  IFS=$'\t' read -r begin_state begin_revision begin_attempt_state \
    <<<"$begin_identity"
  [[ $begin_revision =~ ^[1-9][0-9]*$ ]] || return 1

  case "$begin_state" in
    resumed)
      test "$begin_status" -eq 0 || return 1
      invocation_require_retained_capture \
        "$INVOCATION_PREFENCE_RESUME_ATTESTATION" || return 1
      /usr/bin/jq --exit-status \
        --slurpfile retained_attestation \
          "$INVOCATION_PREFENCE_RESUME_ATTESTATION" '
          .attestation == $retained_attestation[0].attestation
        ' "$INVOCATION_PREFENCE_BEGIN_OBSERVATION" >/dev/null || return 1
      invocation_verify_prefence_attestation \
        host.s22_measured_broker_invocation \
        "$INVOCATION_APPROVAL" "$INVOCATION_PREFENCE_RESUME_ATTESTATION" \
        || return 1
      ;;
    observed_in_flight)
      test "$begin_status" -ne 0 || return 1
      test ! -e "$INVOCATION_PREFENCE_RESUME_ATTESTATION" \
        -a ! -L "$INVOCATION_PREFENCE_RESUME_ATTESTATION" || return 1
      ;;
    observed_completed)
      test "$begin_status" -ne 0 || return 1
      test "$begin_revision" -gt 1 || return 1
      begin_revision=$((begin_revision - 1))
      ;;
    *) return 1 ;;
  esac

  invocation_close_prefence_attempt \
    "$gate_id" "$attempt_id" "$fingerprint" "$begin_revision"
}

invocation_quarantine_prefence_state() {
  test ! -e "$INVOCATION_PREFENCE_QUARANTINE" \
    -a ! -L "$INVOCATION_PREFENCE_QUARANTINE"
  /usr/bin/mv --no-clobber -T -- \
    "$S22_INVOCATION_STATE" "$INVOCATION_PREFENCE_QUARANTINE"
  test ! -e "$S22_INVOCATION_STATE" -a ! -L "$S22_INVOCATION_STATE"
  invocation_assert_owner_directory "$INVOCATION_PREFENCE_QUARANTINE"
  /usr/bin/sync -d "$S22_INVOCATION_STATE_PARENT"
  /usr/bin/printf \
    'quarantined pre-fence invocation state; allocate a fresh canonical state\n' \
    >&2
  exit 75
}

invocation_resolve_prefence_state() {
  local remote_capture gate_identity gate_id fingerprint gate_fields
  local gate_status resolution_reason token_expires_at token_consumed_at
  [[ $INVOCATION_PREFENCE_MODE == true ]] || return 0

  if [[ ! -e $INVOCATION_GATE_CREATE && ! -L $INVOCATION_GATE_CREATE ]]
  then
    for remote_capture in \
      "$INVOCATION_APPROVAL_RESPONSE" \
      "$INVOCATION_ATTESTATION" \
      "$INVOCATION_BEGIN_RESPONSE" \
      "$INVOCATION_LAUNCH_START"
    do
      test ! -e "$remote_capture" -a ! -L "$remote_capture" || return 1
    done
    invocation_quarantine_prefence_state
  fi

  gate_identity=$(invocation_prefence_gate_identity) || return 1
  IFS=$'\t' read -r gate_id fingerprint <<<"$gate_identity"
  invocation_capture_prefence_gate_observation \
    "$gate_id" "$fingerprint" || return 1
  gate_fields=$(
    /usr/bin/jq --exit-status --raw-output '
      [
        .status,
        (.resolution_reason // ""),
        (.execution_token_expires_at // ""),
        (.execution_token_consumed_at // "")
      ]
      | @tsv
    ' "$INVOCATION_PREFENCE_GATE_OBSERVATION"
  ) || return 1
  IFS=$'\t' read -r gate_status resolution_reason \
    token_expires_at token_consumed_at <<<"$gate_fields"

  case "$gate_status" in
    pending)
      return 1
      ;;
    denied)
      [[ $resolution_reason == denied \
        || $resolution_reason == timeout \
        || $resolution_reason == escalation_exhausted ]] || return 1
      invocation_quarantine_prefence_state
      ;;
    cancelled)
      [[ $resolution_reason == cancelled ]] || return 1
      invocation_quarantine_prefence_state
      ;;
    approved)
      [[ $resolution_reason == approved ]] || return 1
      if [[ -z $token_consumed_at ]]; then
        [[ -n $token_expires_at ]] || return 1
        invocation_token_expiry_has_elapsed "$token_expires_at" || return 1
      else
        invocation_recover_consumed_prefence_attempt \
          "$gate_id" "$fingerprint" || return 1
      fi
      invocation_quarantine_prefence_state
      ;;
    *) return 1 ;;
  esac
}

[[ $S22_INVOCATION_NONCE =~ ^[0-9a-f]{64}$ ]]
/usr/bin/jq --exit-status --arg approval_path "$INSTALL_APPROVAL" '
  ."state" == "completed"
  and ."repeat_privileged_launch" == false
  and ."rollback_outcome" == null
  and ."receipt"."state" == "postcommit_verified"
  and ."receipt"."approval_file"."path" == $approval_path
  and ."receipt"."production_deploy" == false
' "$INSTALL_RECONCILIATION" >/dev/null

INVOCATION_INSTALL_RECEIPT=$(
  /usr/bin/jq --exit-status --raw-output '.state_paths.public_receipt' \
    "$INSTALL_APPROVAL"
)
INVOCATION_EXPECTED_PUBLICATION=$(
  /usr/bin/jq --exit-status --raw-output '
    .provision_plan.value.install
    | select(.publication_name == "publication")
    | "\(.publication_parent)/\(.publication_name)"
  ' "$INSTALL_APPROVAL"
)
test -f "$INVOCATION_INSTALL_RECEIPT" -a ! -L "$INVOCATION_INSTALL_RECEIPT"

INVOCATION_APPROVAL="$S22_INVOCATION_STATE/approval.json"
INVOCATION_APPROVAL_STDOUT="$S22_INVOCATION_STATE/approval.stdout.json"
INVOCATION_GATE_REQUEST="$S22_INVOCATION_STATE/gate-request.json"
INVOCATION_GATE_CREATE="$S22_INVOCATION_STATE/gate-create.json"
INVOCATION_APPROVAL_RESPONSE="$S22_INVOCATION_STATE/approval-response.json"
INVOCATION_ATTESTATION="$S22_INVOCATION_STATE/approval-begin-attestation.json"
INVOCATION_BEGIN_RESPONSE="$S22_INVOCATION_STATE/execution-begin.json"
INVOCATION_LAUNCH_START="$S22_INVOCATION_STATE/launch-start.json"
INVOCATION_LAUNCH_PUBLICATION="$S22_INVOCATION_STATE/launch-publication.json"
INVOCATION_RECONSTRUCTED_PUBLICATION="$S22_INVOCATION_STATE/reconstructed-publication.json"
INVOCATION_PRIVILEGED_ARGV_NUL="$S22_INVOCATION_STATE/privileged-argv.nul"
INVOCATION_ROOT_RESULT="$S22_INVOCATION_STATE/root-result.txt"
INVOCATION_RECONCILIATION_ARGV_NUL="$S22_INVOCATION_STATE/reconciliation-argv.nul"
INVOCATION_RECONCILIATION="$S22_INVOCATION_STATE/reconciliation.json"
INVOCATION_FINISH_RESPONSE="$S22_INVOCATION_STATE/execution-finish.json"
INVOCATION_PREFENCE_GATE_OBSERVATION=\
"$S22_INVOCATION_STATE/pre-fence-gate-observation.json"
INVOCATION_PREFENCE_BEGIN_OBSERVATION=\
"$S22_INVOCATION_STATE/pre-fence-execution-begin.json"
INVOCATION_PREFENCE_RESUME_ATTESTATION=\
"$S22_INVOCATION_STATE/pre-fence-resume-attestation.json"
INVOCATION_PREFENCE_FINISH_RESPONSE=\
"$S22_INVOCATION_STATE/pre-fence-execution-finish.json"
INVOCATION_PREFENCE_QUARANTINE=\
"$S22_INVOCATION_STATE_PARENT/quarantine-$(
  /usr/bin/basename -- "$S22_INVOCATION_STATE"
)-pre-fence"
test "$(/usr/bin/dirname -- "$INVOCATION_PREFENCE_QUARANTINE")" = \
  "$S22_INVOCATION_STATE_PARENT"
test "$INVOCATION_PREFENCE_QUARANTINE" != "$S22_INVOCATION_STATE"

for invocation_capture in \
  "$INVOCATION_APPROVAL" \
  "$INVOCATION_APPROVAL_STDOUT" \
  "$INVOCATION_GATE_REQUEST" \
  "$INVOCATION_GATE_CREATE" \
  "$INVOCATION_APPROVAL_RESPONSE" \
  "$INVOCATION_ATTESTATION" \
  "$INVOCATION_BEGIN_RESPONSE" \
  "$INVOCATION_LAUNCH_START" \
  "$INVOCATION_LAUNCH_PUBLICATION" \
  "$INVOCATION_RECONSTRUCTED_PUBLICATION" \
  "$INVOCATION_PRIVILEGED_ARGV_NUL" \
  "$INVOCATION_ROOT_RESULT" \
  "$INVOCATION_RECONCILIATION_ARGV_NUL" \
  "$INVOCATION_RECONCILIATION" \
  "$INVOCATION_FINISH_RESPONSE" \
  "$INVOCATION_PREFENCE_GATE_OBSERVATION" \
  "$INVOCATION_PREFENCE_BEGIN_OBSERVATION" \
  "$INVOCATION_PREFENCE_RESUME_ATTESTATION" \
  "$INVOCATION_PREFENCE_FINISH_RESPONSE"
do
  if [[ -e $invocation_capture || -L $invocation_capture ]]; then
    invocation_assert_capture_file "$invocation_capture"
  fi
done

invocation_resolve_prefence_state
INVOCATION_NEW_LAUNCH=false
# END S22 INVOCATION REBOOT RESUME CUSTODY

# A retained state directory without a valid launch-start is pre-fence
# incomplete, not normal recovery, and can never enter the first-attempt branch
# again. If gate creation never started, exclusively quarantine it. Otherwise
# take a fresh exact gate observation. A pending gate remains in place until it
# is denied or cancelled. An approved unconsumed capability remains in place
# until its exact expiry has elapsed. For an approved consumed capability,
# re-begin only the deterministic retained attempt with the exact token and
# fingerprint. An observed attempt never authorizes work; a resumed attempt's
# new attestation is verified before its accepted revision is finished with
# terminal_failure and s22_invocation_prelaunch_interrupted. No pre-fence path
# creates or approves a replacement gate, writes launch-start, or dispatches
# host work. Quarantine is an exclusive no-clobber rename, the parent is synced,
# and exit 75 prevents same-shell allocation of a replacement state.

# The whole authority-creating path is one first-attempt branch. A retained
# state directory must contain a durable launch-start and enters only the
# validating branch; it cannot fall through to gate, begin, launch, or dispatch.
if [[ $INVOCATION_RECOVERY_MODE == false ]]; then
  test ! -e "$INVOCATION_EXPECTED_PUBLICATION" \
    -a ! -L "$INVOCATION_EXPECTED_PUBLICATION"
  invocation_assert_new_capture_path "$INVOCATION_APPROVAL"
  invocation_capture_stdout "$INVOCATION_APPROVAL_STDOUT" \
    run_s22_invocation_action_tool approval-payload \
    --invocation-nonce "$S22_INVOCATION_NONCE" \
    --install-approval "$INSTALL_APPROVAL" \
    --install-receipt "$INVOCATION_INSTALL_RECEIPT" \
    --expected-publication "$INVOCATION_EXPECTED_PUBLICATION" \
    --bun "$S22_PINNED_BUN" \
    --action-tool "$S22_INVOCATION_ACTION_TOOL" \
    --executor "$S22_INVOCATION_EXECUTOR" \
    --approval-begin-verifier "$S22_APPROVAL_BEGIN_VERIFIER" \
    --approval-begin-keys "$S22_APPROVAL_BEGIN_KEYS" \
    --output "$INVOCATION_APPROVAL"
  invocation_assert_capture_file "$INVOCATION_APPROVAL"
  /usr/bin/cmp -- "$INVOCATION_APPROVAL" "$INVOCATION_APPROVAL_STDOUT"

  INVOCATION_FINGERPRINT=$(
    run_s22_invocation_action_tool approval-fingerprint \
      --approval "$INVOCATION_APPROVAL"
  )
  [[ $INVOCATION_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]

  invocation_capture_stdout "$INVOCATION_GATE_REQUEST" /usr/bin/jq -nS \
    --arg type host.s22_measured_broker_invocation \
    --arg summary \
      "Perform exactly one measured broker invocation; no service, traffic, network, or deployment" \
    --arg approver "$APPROVER_IDENTITY" \
    --slurpfile action "$INVOCATION_APPROVAL" '
      {
        action_type: $type,
        action_summary: $summary,
        action_payload: $action[0],
        resource_refs: [],
        risk_level: "high",
        approval_policy: {mode: "any", identities: [$approver], roles: []},
        timeout_policy: {timeout_seconds: 7200},
        offline_fallback: {
          enabled: false, idle_seconds: 14400,
          fallback_identities: [], fallback_roles: []
        },
        escalation_policy: {
          on_idle: "none", on_deny: "abort",
          escalation_identities: [], escalation_roles: []
        }
      }
    '

  invocation_capture_stdout "$INVOCATION_GATE_CREATE" \
    run_s22_invocation_chorus_cli approvals create \
    --profile inu --from-file "$INVOCATION_GATE_REQUEST" --json
  /usr/bin/jq --exit-status \
    --arg type host.s22_measured_broker_invocation \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --slurpfile action "$INVOCATION_APPROVAL" '
      ."action_type" == $type
      and ."action_fingerprint" == $fingerprint
      and ."action_payload" == $action[0]
      and ."risk_level" == "high"
      and ."status" == "pending"
    ' "$INVOCATION_GATE_CREATE" >/dev/null
  S22_INVOCATION_GATE_ID=$(
    /usr/bin/jq --exit-status --raw-output '.id' "$INVOCATION_GATE_CREATE"
  )

  # HUMAN CHECKPOINT: inspect INVOCATION_APPROVAL, then approve this gate once.
  invocation_capture_stdout "$INVOCATION_APPROVAL_RESPONSE" \
    run_s22_invocation_chorus_cli approvals approve \
    "$S22_INVOCATION_GATE_ID" --profile inu \
    --note "I authorize exactly one local measured broker invocation, with no service start, traffic, network, or deployment." \
    --json

  S22_INVOCATION_ATTEMPT_ID="s22-invocation-$S22_INVOCATION_NONCE"
  invocation_assert_new_capture_path "$INVOCATION_ATTESTATION"
  invocation_capture_stdout "$INVOCATION_BEGIN_RESPONSE" \
    run_s22_invocation_chorus_cli approvals execution begin \
    --attempt-id "$S22_INVOCATION_ATTEMPT_ID" \
    --approval-response "$INVOCATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INVOCATION_FINGERPRINT" \
    --attestation-output "$INVOCATION_ATTESTATION" \
    --profile inu --json
  invocation_assert_capture_file "$INVOCATION_ATTESTATION"

  INVOCATION_REVISION=$(
    /usr/bin/jq --exit-status --raw-output \
      --arg gate "$S22_INVOCATION_GATE_ID" \
      --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
      --arg fingerprint "$INVOCATION_FINGERPRINT" '
        select(
          (."status" == "accepted" or ."status" == "resumed")
          and ."execution_authorized" == true
          and ."attempt"."gate_id" == $gate
          and ."attempt"."attempt_id" == $attempt
          and ."attempt"."request_fingerprint" == $fingerprint
          and (."attempt"."revision" | type == "number" and . >= 1 and floor == .)
        )
        | ."attempt"."revision"
      ' "$INVOCATION_BEGIN_RESPONSE"
  )

  invocation_assert_new_capture_path "$INVOCATION_LAUNCH_START"
  invocation_capture_stdout "$INVOCATION_LAUNCH_PUBLICATION" \
    run_s22_invocation_action_tool launch-start \
    --approval "$INVOCATION_APPROVAL" \
    --approval-attestation "$INVOCATION_ATTESTATION" \
    --path "$INVOCATION_LAUNCH_START" \
    --expected-gate-id "$S22_INVOCATION_GATE_ID" \
    --expected-attempt-id "$S22_INVOCATION_ATTEMPT_ID"
  invocation_assert_capture_file "$INVOCATION_LAUNCH_START"
  INVOCATION_LAUNCH_START_SHA256=$(
    /usr/bin/sha256sum -- "$INVOCATION_LAUNCH_START" \
      | /usr/bin/cut -d' ' -f1
  )
  INVOCATION_LAUNCH_START_SIZE=$(
    /usr/bin/stat -Lc '%s' -- "$INVOCATION_LAUNCH_START"
  )
  INVOCATION_LAUNCH_PUBLICATION_SHA256=$(
    /usr/bin/sha256sum -- "$INVOCATION_LAUNCH_PUBLICATION" \
      | /usr/bin/cut -d' ' -f1
  )
  INVOCATION_NEW_LAUNCH=true
else
  # BEGIN S22 INVOCATION RETAINED STATE VALIDATION
  for invocation_retained in \
    "$INVOCATION_APPROVAL" \
    "$INVOCATION_APPROVAL_STDOUT" \
    "$INVOCATION_GATE_REQUEST" \
    "$INVOCATION_GATE_CREATE" \
    "$INVOCATION_APPROVAL_RESPONSE" \
    "$INVOCATION_ATTESTATION" \
    "$INVOCATION_BEGIN_RESPONSE" \
    "$INVOCATION_LAUNCH_START"
  do
    invocation_require_retained_capture "$invocation_retained"
  done
  /usr/bin/cmp -- "$INVOCATION_APPROVAL" "$INVOCATION_APPROVAL_STDOUT"

  INVOCATION_FINGERPRINT=$(
    run_s22_invocation_action_tool approval-fingerprint \
      --approval "$INVOCATION_APPROVAL"
  )
  [[ $INVOCATION_FINGERPRINT =~ ^[0-9a-f]{64}$ ]]
  S22_INVOCATION_GATE_ID=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_gate_id' "$INVOCATION_LAUNCH_START"
  )
  S22_INVOCATION_ATTEMPT_ID=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_attempt_id' "$INVOCATION_LAUNCH_START"
  )
  INVOCATION_REVISION=$(
    /usr/bin/jq --exit-status --raw-output \
      '.authorization.approval_revision' "$INVOCATION_LAUNCH_START"
  )
  [[ $S22_INVOCATION_GATE_ID =~ ^approval_gate: ]]
  [[ $S22_INVOCATION_ATTEMPT_ID =~ ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ ]]
  [[ $INVOCATION_REVISION =~ ^[1-9][0-9]*$ ]]
  INVOCATION_APPROVAL_SHA256=$(
    /usr/bin/sha256sum -- "$INVOCATION_APPROVAL" \
      | /usr/bin/cut -d' ' -f1
  )
  INVOCATION_APPROVAL_SIZE=$(
    /usr/bin/stat -Lc '%s' -- "$INVOCATION_APPROVAL"
  )

  /usr/bin/jq --exit-status \
    --arg nonce "$S22_INVOCATION_NONCE" '
      .schema_version == "chorus.s22-measured-broker-invocation-approval/1"
      and .action_type == "host.s22_measured_broker_invocation"
      and .invocation_nonce == $nonce
    ' "$INVOCATION_APPROVAL" >/dev/null
  /usr/bin/jq --exit-status \
    --slurpfile approval "$INVOCATION_APPROVAL" '
      .action_type == "host.s22_measured_broker_invocation"
      and .action_payload == $approval[0]
      and .risk_level == "high"
      and .approval_policy.mode == "any"
      and .offline_fallback.enabled == false
    ' "$INVOCATION_GATE_REQUEST" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --slurpfile approval "$INVOCATION_APPROVAL" '
      .id == $gate
      and .action_type == "host.s22_measured_broker_invocation"
      and .action_fingerprint == $fingerprint
      and .action_payload == $approval[0]
      and (.status == "pending" or .status == "approved")
    ' "$INVOCATION_GATE_CREATE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" '
      (.data // .gate // .) as $response
      | $response.id == $gate
      and $response.action_fingerprint == $fingerprint
      and (
        (.execution_token // .data.execution_token // .gate.execution_token)
        | if type == "object" then .token else . end
        | type == "string" and length >= 1 and length <= 512
      )
    ' "$INVOCATION_APPROVAL_RESPONSE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --arg revision "$INVOCATION_REVISION" '
      .attestation.payload.schema_version ==
        "chorus.approval-execution-begin-attestation/1"
      and .attestation.payload.gate_action_type ==
        "host.s22_measured_broker_invocation"
      and .attestation.payload.gate_id == $gate
      and .attestation.payload.execution_authorized == true
      and .attestation.payload.attempt.gate_id == $gate
      and .attestation.payload.attempt.attempt_id == $attempt
      and .attestation.payload.attempt.request_fingerprint == $fingerprint
      and (.attestation.payload.attempt.revision | tostring) == $revision
      and (.attestation.signature_base64url | type == "string" and length > 0)
    ' "$INVOCATION_ATTESTATION" >/dev/null
  invocation_verify_prefence_attestation \
    host.s22_measured_broker_invocation \
    "$INVOCATION_APPROVAL" "$INVOCATION_ATTESTATION"
  /usr/bin/jq --exit-status \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --arg revision "$INVOCATION_REVISION" '
      (."status" == "accepted" or ."status" == "resumed")
      and ."execution_authorized" == true
      and ."attempt"."gate_id" == $gate
      and ."attempt"."attempt_id" == $attempt
      and ."attempt"."request_fingerprint" == $fingerprint
      and .attempt.state == "accepted"
      and (."attempt"."revision" | tostring) == $revision
    ' "$INVOCATION_BEGIN_RESPONSE" >/dev/null
  /usr/bin/jq --exit-status \
    --arg approval "$INVOCATION_APPROVAL" \
    --arg approval_sha256 "$INVOCATION_APPROVAL_SHA256" \
    --argjson approval_size "$INVOCATION_APPROVAL_SIZE" \
    --argjson owner_uid "$INVOCATION_OPERATOR_UID" \
    --argjson owner_gid "$INVOCATION_OPERATOR_GID" \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --arg revision "$INVOCATION_REVISION" '
      .schema_version == "chorus.s22-measured-broker-action-launch-start/1"
      and .action_type == "host.s22_measured_broker_invocation"
      and .approval_fingerprint == $fingerprint
      and .approval_file.path == $approval
      and .approval_file.sha256 == $approval_sha256
      and .approval_file.size_bytes == $approval_size
      and .approval_file.mode == "0600"
      and .approval_file.uid == $owner_uid
      and .approval_file.gid == $owner_gid
      and .approval_file.link_count == 1
      and .authorization.approval_gate_id == $gate
      and .authorization.approval_attempt_id == $attempt
      and .authorization.request_fingerprint == $fingerprint
      and .authorization.approval_revision == $revision
      and .authorization.execution_authorized == true
      and .state == "sudo-dispatch-started"
      and .root_launch_may_have_begun == true
      and .repeat_privileged_launch == false
      and .production_deploy == false
    ' "$INVOCATION_LAUNCH_START" >/dev/null
  INVOCATION_NEW_LAUNCH=false
  # END S22 INVOCATION RETAINED STATE VALIDATION
fi
INVOCATION_APPROVAL_SHA256=$(
  /usr/bin/sha256sum -- "$INVOCATION_APPROVAL" \
    | /usr/bin/cut -d' ' -f1
)
INVOCATION_APPROVAL_SIZE=$(
  /usr/bin/stat -Lc '%s' -- "$INVOCATION_APPROVAL"
)
INVOCATION_TRANSACTION_ID=$(
  /usr/bin/jq --exit-status --raw-output \
    --arg nonce "$S22_INVOCATION_NONCE" '
      select(
        .action_type == "host.s22_measured_broker_invocation"
        and .invocation_nonce == $nonce
        and (.transaction_id | type == "string"
          and test("^[0-9a-f]{64}$"))
      )
      | .transaction_id
    ' "$INVOCATION_APPROVAL"
)
INVOCATION_LAUNCH_START_SHA256=$(
  /usr/bin/sha256sum -- "$INVOCATION_LAUNCH_START" \
    | /usr/bin/cut -d' ' -f1
)
INVOCATION_LAUNCH_START_SIZE=$(
  /usr/bin/stat -Lc '%s' -- "$INVOCATION_LAUNCH_START"
)

Only the uninterrupted operator that captured the original launch-start stdout may materialize its emitted privileged_argv, and may execute it exactly once. The durable launch-start is the no-replay fence. If stdout is missing or uncertain, execute no privileged vector:

# BEGIN S22 INVOCATION PRIVILEGED PUBLICATION VALIDATION
INVOCATION_ROOT_STATUS=125
if [[ $INVOCATION_NEW_LAUNCH == true \
  && -s $INVOCATION_LAUNCH_PUBLICATION ]]
then
  # These are dispatch-time checks, not observations inherited from launch-start.
  invocation_assert_capture_file "$INVOCATION_LAUNCH_PUBLICATION"
  test "$(/usr/bin/realpath -e -- "$INVOCATION_LAUNCH_PUBLICATION")" = \
    "$INVOCATION_LAUNCH_PUBLICATION"
  test "$(/usr/bin/sha256sum -- "$INVOCATION_LAUNCH_PUBLICATION")" = \
    "$INVOCATION_LAUNCH_PUBLICATION_SHA256  $INVOCATION_LAUNCH_PUBLICATION"
  /usr/bin/jq --exit-status \
    --arg launch_start "$INVOCATION_LAUNCH_START" \
    --arg launch_start_sha256 "$INVOCATION_LAUNCH_START_SHA256" \
    --argjson launch_start_size "$INVOCATION_LAUNCH_START_SIZE" \
    --argjson owner_uid "$INVOCATION_OPERATOR_UID" \
    --argjson owner_gid "$INVOCATION_OPERATOR_GID" \
    --arg gate "$S22_INVOCATION_GATE_ID" \
    --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
    --arg fingerprint "$INVOCATION_FINGERPRINT" \
    --arg revision "$INVOCATION_REVISION" '
      .schema_version ==
        "chorus.s22-measured-broker-action-launch-publication/1"
      and .file.path == $launch_start
      and .file.sha256 == $launch_start_sha256
      and .file.size_bytes == $launch_start_size
      and .file.mode == "0600"
      and .file.uid == $owner_uid
      and .file.gid == $owner_gid
      and .file.link_count == 1
      and .launch_start.authorization.approval_gate_id == $gate
      and .launch_start.authorization.approval_attempt_id == $attempt
      and .launch_start.authorization.request_fingerprint == $fingerprint
      and .launch_start.authorization.approval_revision == $revision
      and .launch_start.authorization.execution_authorized == true
      and .launch_start.repeat_privileged_launch == false
      and .repeat_privileged_launch == false
      and .production_deploy == false
      and (.privileged_argv | type == "array" and length > 0
        and all(.[];
          type == "string" and length > 0
          and (index("\u0000") == null)))
    ' "$INVOCATION_LAUNCH_PUBLICATION" >/dev/null
  INVOCATION_EXPECTED_PRIVILEGED_ARGV_COUNT=$(
    /usr/bin/jq --exit-status --raw-output \
      '.privileged_argv | length' "$INVOCATION_LAUNCH_PUBLICATION"
  )
  invocation_capture_stdout "$INVOCATION_PRIVILEGED_ARGV_NUL" \
    /usr/bin/jq --join-output '.privileged_argv[] | . + "\u0000"' \
    "$INVOCATION_LAUNCH_PUBLICATION"
  mapfile -d '' -t INVOCATION_PRIVILEGED_ARGV \
    <"$INVOCATION_PRIVILEGED_ARGV_NUL"
  test "${#INVOCATION_PRIVILEGED_ARGV[@]}" -eq \
    "$INVOCATION_EXPECTED_PRIVILEGED_ARGV_COUNT"
  # Recheck the lstat/resolved metadata and exact parsed bytes after argv
  # materialization and immediately before dispatch.
  invocation_assert_capture_file "$INVOCATION_LAUNCH_PUBLICATION"
  test "$(/usr/bin/sha256sum -- "$INVOCATION_LAUNCH_PUBLICATION")" = \
    "$INVOCATION_LAUNCH_PUBLICATION_SHA256  $INVOCATION_LAUNCH_PUBLICATION"
  invocation_assert_toolchain
  if invocation_capture_stdout "$INVOCATION_ROOT_RESULT" \
    "${INVOCATION_PRIVILEGED_ARGV[@]}"
  then
    INVOCATION_ROOT_STATUS=0
  else
    INVOCATION_ROOT_STATUS=$?
  fi
fi
# END S22 INVOCATION PRIVILEGED PUBLICATION VALIDATION

reconstruct-launch is only for a lost launch-publication stdout after the durable launch-start exists. It recovers the audit and emitted reconciliation vectors; it never authorizes execution or replay of its privileged_argv:

# BEGIN S22 INVOCATION RECONSTRUCTION RECONCILIATION
INVOCATION_RECONCILIATION_VERIFIED=false
INVOCATION_PUBLICATION_VERIFIED=false
INVOCATION_EFFECTIVE_PUBLICATION=
invocation_require_retained_capture "$INVOCATION_LAUNCH_START"
invocation_verify_prefence_attestation \
  host.s22_measured_broker_invocation \
  "$INVOCATION_APPROVAL" "$INVOCATION_ATTESTATION"
invocation_select_reusable_capture INVOCATION_RECONSTRUCTED_PUBLICATION || :
INVOCATION_RECONSTRUCTED_PUBLICATION=\
"$INVOCATION_RECONSTRUCTED_PUBLICATION_NEXT"
INVOCATION_RECONSTRUCTION_STATUS=0
if invocation_capture_stdout "$INVOCATION_RECONSTRUCTED_PUBLICATION" \
  run_s22_invocation_action_tool reconstruct-launch \
    --approval "$INVOCATION_APPROVAL" \
    --approval-attestation "$INVOCATION_ATTESTATION" \
    --launch-start "$INVOCATION_LAUNCH_START" \
    --expected-gate-id "$S22_INVOCATION_GATE_ID" \
    --expected-attempt-id "$S22_INVOCATION_ATTEMPT_ID"
then
  INVOCATION_EFFECTIVE_PUBLICATION=$INVOCATION_RECONSTRUCTED_PUBLICATION
else
  INVOCATION_RECONSTRUCTION_STATUS=$?
fi

if [[ -n $INVOCATION_EFFECTIVE_PUBLICATION ]] && /usr/bin/jq --exit-status \
  --arg launch_start "$INVOCATION_LAUNCH_START" \
  --arg launch_start_sha256 "$INVOCATION_LAUNCH_START_SHA256" \
  --argjson launch_start_size "$INVOCATION_LAUNCH_START_SIZE" \
  --argjson owner_uid "$INVOCATION_OPERATOR_UID" \
  --argjson owner_gid "$INVOCATION_OPERATOR_GID" \
  --arg gate "$S22_INVOCATION_GATE_ID" \
  --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
  --arg fingerprint "$INVOCATION_FINGERPRINT" \
  --arg revision "$INVOCATION_REVISION" '
    .schema_version ==
      "chorus.s22-measured-broker-action-launch-publication/1"
    and .file.path == $launch_start
    and .file.sha256 == $launch_start_sha256
    and .file.size_bytes == $launch_start_size
    and .file.mode == "0600"
    and .file.uid == $owner_uid
    and .file.gid == $owner_gid
    and .file.link_count == 1
    and .launch_start.action_type ==
      "host.s22_measured_broker_invocation"
    and .launch_start.authorization.approval_gate_id == $gate
    and .launch_start.authorization.approval_attempt_id == $attempt
    and .launch_start.authorization.request_fingerprint == $fingerprint
    and .launch_start.authorization.approval_revision == $revision
    and .launch_start.authorization.execution_authorized == true
    and .launch_start.root_launch_may_have_begun == true
    and .launch_start.repeat_privileged_launch == false
    and .repeat_privileged_launch == false
    and .production_deploy == false
    and (.reconciliation_argv | type == "array" and length > 0
      and all(.[];
        type == "string" and length > 0
        and (index("\u0000") == null)))
  ' "$INVOCATION_EFFECTIVE_PUBLICATION" >/dev/null
then
  INVOCATION_PUBLICATION_VERIFIED=true
fi

if [[ $INVOCATION_PUBLICATION_VERIFIED == true ]]; then
  INVOCATION_EXPECTED_RECONCILIATION_ARGV_COUNT=$(
    /usr/bin/jq --exit-status --raw-output \
      '.reconciliation_argv | length' "$INVOCATION_EFFECTIVE_PUBLICATION"
  )
  INVOCATION_EXPECTED_RECONCILIATION_ARGV_SHA256=$(
    /usr/bin/jq --join-output '.reconciliation_argv[] | . + "\u0000"' \
      "$INVOCATION_EFFECTIVE_PUBLICATION" \
      | /usr/bin/sha256sum | /usr/bin/cut -d' ' -f1
  )
  INVOCATION_RECONCILIATION_ARGV_STATUS=0
  invocation_select_reusable_capture INVOCATION_RECONCILIATION_ARGV_NUL \
    || :
  INVOCATION_RECONCILIATION_ARGV_NUL=\
"$INVOCATION_RECONCILIATION_ARGV_NUL_NEXT"
  if invocation_capture_stdout "$INVOCATION_RECONCILIATION_ARGV_NUL" \
    /usr/bin/jq --join-output '.reconciliation_argv[] | . + "\u0000"' \
      "$INVOCATION_EFFECTIVE_PUBLICATION"
  then
    :
  else
    INVOCATION_RECONCILIATION_ARGV_STATUS=$?
  fi

  INVOCATION_RECONCILIATION_ARGV_VERIFIED=false
  if [[ $INVOCATION_RECONCILIATION_ARGV_STATUS -eq 0 \
    && -s $INVOCATION_RECONCILIATION_ARGV_NUL ]]
  then
    invocation_require_retained_capture "$INVOCATION_RECONCILIATION_ARGV_NUL"
    if invocation_load_exact_reconciliation_argv \
      "$INVOCATION_RECONCILIATION_ARGV_NUL" \
      "$INVOCATION_EXPECTED_RECONCILIATION_ARGV_SHA256" \
      "$INVOCATION_EXPECTED_RECONCILIATION_ARGV_COUNT"
    then
      INVOCATION_RECONCILIATION_ARGV_VERIFIED=true
    fi
  fi

  if [[ $INVOCATION_RECONCILIATION_ARGV_VERIFIED == true ]]; then
    INVOCATION_RECONCILIATION_STATUS=0
    invocation_select_reusable_capture INVOCATION_RECONCILIATION || :
    INVOCATION_RECONCILIATION=$INVOCATION_RECONCILIATION_NEXT
    invocation_assert_toolchain
    if invocation_capture_stdout "$INVOCATION_RECONCILIATION" \
      "${INVOCATION_RECONCILIATION_ARGV[@]}"
    then
      :
    else
      INVOCATION_RECONCILIATION_STATUS=$?
    fi

    # BEGIN S22 INVOCATION RECONCILIATION RECEIPT VALIDATION
    # The transaction is the canonical hash of the retained approval, including
    # its operator nonce. The approval fact and both publication paths prevent a
    # valid receipt from another invocation from closing this attempt.
    if [[ $INVOCATION_RECONCILIATION_STATUS -eq 0 \
      && -s $INVOCATION_RECONCILIATION ]] \
      && /usr/bin/jq --exit-status \
        --arg action host.s22_measured_broker_invocation \
        --arg gate "$S22_INVOCATION_GATE_ID" \
        --arg attempt "$S22_INVOCATION_ATTEMPT_ID" \
        --arg fingerprint "$INVOCATION_FINGERPRINT" \
        --arg revision "$INVOCATION_REVISION" \
        --arg transaction "$INVOCATION_TRANSACTION_ID" \
        --arg nonce "$S22_INVOCATION_NONCE" \
        --arg approval "$INVOCATION_APPROVAL" \
        --arg approval_sha256 "$INVOCATION_APPROVAL_SHA256" \
        --arg publication "$INVOCATION_EXPECTED_PUBLICATION" \
        --argjson approval_size "$INVOCATION_APPROVAL_SIZE" '
          ."state" == "completed"
          and ."action_type" == $action
          and ."repeat_privileged_launch" == false
          and ."privileged_replay" == false
          and ."read_only" == true
          and ."production_deploy" == false
          and .receipt.state == "completed"
          and .receipt.action_type == $action
          and .receipt.transaction_id == $transaction
          and .receipt.approval_fingerprint == $fingerprint
          and .receipt.authorization.approval_gate_id == $gate
          and .receipt.authorization.approval_attempt_id == $attempt
          and .receipt.authorization.request_fingerprint == $fingerprint
          and .receipt.authorization.approval_revision == $revision
          and .receipt.authorization.execution_authorized == true
          and .receipt.approval_file.path == $approval
          and .receipt.approval_file.sha256 == $approval_sha256
          and .receipt.approval_file.size_bytes == $approval_size
          and .receipt.launch_fence.value.expected_publication.directory ==
            $publication
          and .receipt.evidence.value.native_publication.directory.path ==
            $publication
          and .receipt.evidence.value.invocation_authority.nonce == $nonce
          and .receipt.one_measured_broker_invocation == true
          and .receipt.repeat_privileged_launch == false
          and .receipt.service_start == false
          and .receipt.production_deploy == false
          and .receipt.production_traffic == false
          and .receipt.external_network_access == false
        ' "$INVOCATION_RECONCILIATION" >/dev/null
    then
      INVOCATION_RECONCILIATION_VERIFIED=true
    fi
    # END S22 INVOCATION RECONCILIATION RECEIPT VALIDATION
  fi
fi
# END S22 INVOCATION RECONSTRUCTION RECONCILIATION

The generated reconciliation vector is authoritative and read-only; do not hand-build a reconcile command. Only the exact completed state above permits success. Finish the same accepted attempt and exact recorded revision after reconciliation. Any other state must be finished with its accurately classified retryable_failure or terminal_failure outcome and error, without another privileged launch. A retained finish response is validation input, not a pathname to overwrite:

# BEGIN S22 INVOCATION FINISH CUSTODY
INVOCATION_OUTCOME=terminal_failure
INVOCATION_ERROR_ARGS=(--error "s22_invocation_reconciliation_not_completed")
if [[ $INVOCATION_RECONCILIATION_VERIFIED == true ]]; then
  INVOCATION_OUTCOME=succeeded
  INVOCATION_ERROR_ARGS=()
fi

INVOCATION_FINISH_STATUS=0
INVOCATION_FINISH_RESPONSE_BASE=$INVOCATION_FINISH_RESPONSE
INVOCATION_FINISH_CAPTURE_VALID=false
if invocation_select_reusable_capture INVOCATION_FINISH_RESPONSE; then
  :
else
  if invocation_capture_stdout "$INVOCATION_FINISH_RESPONSE" \
    run_s22_invocation_chorus_cli approvals execution finish \
    --attempt-id "$S22_INVOCATION_ATTEMPT_ID" \
    --approval-response "$INVOCATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INVOCATION_FINGERPRINT" \
    --revision "$INVOCATION_REVISION" \
    --outcome "$INVOCATION_OUTCOME" \
    "${INVOCATION_ERROR_ARGS[@]}" \
    --profile inu --json
  then
    :
  else
    INVOCATION_FINISH_STATUS=$?
  fi
fi
if [[ -s $INVOCATION_FINISH_RESPONSE ]] \
  && INVOCATION_FINISH_STATE=$(
    invocation_finish_state_from_capture \
      "$INVOCATION_FINISH_RESPONSE" \
      "$S22_INVOCATION_GATE_ID" \
      "$S22_INVOCATION_ATTEMPT_ID" \
      "$INVOCATION_FINGERPRINT" \
      "$INVOCATION_REVISION"
  )
then
  INVOCATION_FINISH_CAPTURE_VALID=true
fi

# Preserve an invalid nonempty response and advance to a new exclusive retry.
# Execution-finish is idempotent for this exact attempt and revision; no other
# remote or privileged operation may be retried here.
if [[ $INVOCATION_FINISH_CAPTURE_VALID == false ]]; then
  INVOCATION_FINISH_RESPONSE=$INVOCATION_FINISH_RESPONSE_BASE
  invocation_select_reusable_capture INVOCATION_FINISH_RESPONSE || :
  INVOCATION_FINISH_RESPONSE=$INVOCATION_FINISH_RESPONSE_NEXT
  INVOCATION_FINISH_STATUS=0
  if invocation_capture_stdout "$INVOCATION_FINISH_RESPONSE" \
    run_s22_invocation_chorus_cli approvals execution finish \
    --attempt-id "$S22_INVOCATION_ATTEMPT_ID" \
    --approval-response "$INVOCATION_APPROVAL_RESPONSE" \
    --expected-action-fingerprint "$INVOCATION_FINGERPRINT" \
    --revision "$INVOCATION_REVISION" \
    --outcome "$INVOCATION_OUTCOME" \
    "${INVOCATION_ERROR_ARGS[@]}" \
    --profile inu --json
  then
    :
  else
    INVOCATION_FINISH_STATUS=$?
  fi
  if [[ -s $INVOCATION_FINISH_RESPONSE ]] \
    && INVOCATION_FINISH_STATE=$(
      invocation_finish_state_from_capture \
        "$INVOCATION_FINISH_RESPONSE" \
        "$S22_INVOCATION_GATE_ID" \
        "$S22_INVOCATION_ATTEMPT_ID" \
        "$INVOCATION_FINGERPRINT" \
        "$INVOCATION_REVISION"
    )
  then
    INVOCATION_FINISH_CAPTURE_VALID=true
  fi
fi
test "$INVOCATION_FINISH_CAPTURE_VALID" = true
invocation_require_retained_capture "$INVOCATION_FINISH_RESPONSE"
case "$INVOCATION_FINISH_STATE" in
  succeeded) ;;
  failed|abandoned)
    INVOCATION_FINISH_ERROR=$(
      /usr/bin/jq --exit-status --raw-output \
        '."attempt"."last_error"' "$INVOCATION_FINISH_RESPONSE"
    )
    /usr/bin/printf \
      'retained invocation attempt is terminal: %s (%s)\n' \
      "$INVOCATION_FINISH_STATE" "$INVOCATION_FINISH_ERROR" >&2
    exit 1
    ;;
  *) exit 1 ;;
esac
test "$INVOCATION_RECONCILIATION_VERIFIED" = true
test "$INVOCATION_FINISH_STATE" = succeeded
# END S22 INVOCATION FINISH CUSTODY

Recovery

• Enter this recovery path only when the normal install’s public receipt is absent. Never infer absence from lost terminal output, and never repeat the original privileged vector. First reconstruct and run the normal read-only reconciliation above. A completed receipt ends recovery.
• If staging fails, change no live destination. Preserve both the failed staging tree and the approved digest for forensics.
• If installation or installed-state verification fails before activation, keep or return the new launcher to 0755. Restore every pre-existing destination from the complete root-only snapshot, remove only transaction-created paths proven by the inventory, remeasure the restored set, and sync every restored file and parent directory. Restore the old launcher’s setuid bit only as the last write after the entire old set verifies. Never delete an unknown or uninventoried path.
• If the setuid-last write happened but invocation has not begun, disable it immediately before rollback. A digest, plan-commitment, or ordered-mapping mismatch invalidates the approval; do not repair the candidate in place.
• Never regenerate the seed to repair a signed campaign. Repair the exact file or abandon the signed authority and start a newly reviewed key/campaign epoch.
• If the broker fails before publication, require target-UID quiescence and inspect the exact error. Do not delete an unknown publication directory.
• If /var/lib/chorus/s22/m001/current-terminal-consumption.json exists, do not rerun the broker. Treat it as a consumed terminal intent and use offline verification.
• A publication without a matching consumption receipt is an incident. Preserve both the publication and fixed authorities, disable the launcher setuid bit, and escalate; never guess whether deletion or replay is safe.
• A stale five-minute plan requires a fresh plan and phase-one candidate. A changed runtime digest requires fresh trust/intent authority, not a bypass.

When the normal public receipt remains absent, create a separate fresh read-only inspection approval for action host.s22_measured_broker_install_recovery_inspection. The inspection payload has this exact required surface; --prior-recovery-approvals is optional and, when present, is the ordered comma-separated list of earlier recovery approvals:

bun run scripts/s22-measured-broker-install-recovery-inspection.ts approval-payload \
  --inspection-nonce "$S22_INSPECTION_NONCE" \
  --original-approval "$INSTALL_APPROVAL" \
  --bun "$S22_PINNED_BUN" \
  --action-tool "$S22_INSPECTION_ACTION_TOOL" \
  --executor "$S22_INSTALL_EXECUTOR" \
  --approval-begin-verifier "$S22_APPROVAL_BEGIN_VERIFIER" \
  --approval-begin-keys "$S22_APPROVAL_BEGIN_KEYS" \
  --approval-schema "$S22_INSTALL_APPROVAL_SCHEMA" \
  --recovery-approval-schema "$S22_INSPECTION_APPROVAL_SCHEMA" \
  --evidence-schema "$S22_INSPECTION_EVIDENCE_SCHEMA" \
  --receipt-schema "$S22_INSPECTION_RECEIPT_SCHEMA" \
  --output "$S22_INSPECTION_APPROVAL"

bun run scripts/s22-measured-broker-install-recovery-inspection.ts \
  approval-fingerprint --approval "$S22_INSPECTION_APPROVAL"
bun run scripts/s22-measured-broker-install-recovery-inspection.ts launch-start \
  --approval "$S22_INSPECTION_APPROVAL" \
  --approval-attestation "$S22_INSPECTION_ATTESTATION" \
  --path "$S22_INSPECTION_LAUNCH_START" \
  --expected-gate-id "$S22_INSPECTION_GATE_ID" \
  --expected-attempt-id "$S22_INSPECTION_ATTEMPT_ID"
bun run scripts/s22-measured-broker-install-recovery-inspection.ts \
  reconstruct-launch \
  --approval "$S22_INSPECTION_APPROVAL" \
  --approval-attestation "$S22_INSPECTION_ATTESTATION" \
  --launch-start "$S22_INSPECTION_LAUNCH_START" \
  --expected-gate-id "$S22_INSPECTION_GATE_ID" \
  --expected-attempt-id "$S22_INSPECTION_ATTEMPT_ID"
bun run scripts/s22-measured-broker-install-recovery-inspection.ts reconcile \
  --approval "$S22_INSPECTION_APPROVAL" \
  --approval-attestation "$S22_INSPECTION_ATTESTATION" \
  --launch-start "$S22_INSPECTION_LAUNCH_START" \
  --receipt "$S22_INSPECTION_RECEIPT"

Apply the same common approvals execution begin, one-time materialized .privileged_argv, generated .reconciliation_argv, completed-state check, and approvals execution finish sequence used by the normal action. The inspection is read-only. Require its sealed completed evidence and receipt before considering repair.

Only after completed inspection may a different separate fresh approval authorize action host.s22_measured_broker_install_recovery. Its exact payload surface is:

bun run scripts/s22-measured-broker-install-recovery.ts approval-payload \
  --original-approval "$INSTALL_APPROVAL" \
  --inspection-approval "$S22_INSPECTION_APPROVAL" \
  --inspection-evidence "$S22_INSPECTION_EVIDENCE" \
  --inspection-receipt "$S22_INSPECTION_RECEIPT" \
  --bun "$S22_PINNED_BUN" \
  --action-tool "$S22_RECOVERY_ACTION_TOOL" \
  --executor "$S22_INSTALL_EXECUTOR" \
  --approval-begin-verifier "$S22_APPROVAL_BEGIN_VERIFIER" \
  --approval-begin-keys "$S22_APPROVAL_BEGIN_KEYS" \
  --approval-schema "$S22_RECOVERY_APPROVAL_SCHEMA" \
  --inspection-evidence-schema "$S22_INSPECTION_EVIDENCE_SCHEMA" \
  --inspection-receipt-schema "$S22_INSPECTION_RECEIPT_SCHEMA" \
  --receipt-schema "$S22_RECOVERY_RECEIPT_SCHEMA" \
  --output "$S22_RECOVERY_APPROVAL"

bun run scripts/s22-measured-broker-install-recovery.ts \
  approval-fingerprint --approval "$S22_RECOVERY_APPROVAL"
bun run scripts/s22-measured-broker-install-recovery.ts launch-start \
  --approval "$S22_RECOVERY_APPROVAL" \
  --approval-attestation "$S22_RECOVERY_ATTESTATION" \
  --path "$S22_RECOVERY_LAUNCH_START" \
  --expected-gate-id "$S22_RECOVERY_GATE_ID" \
  --expected-attempt-id "$S22_RECOVERY_ATTEMPT_ID"
bun run scripts/s22-measured-broker-install-recovery.ts reconstruct-launch \
  --approval "$S22_RECOVERY_APPROVAL" \
  --approval-attestation "$S22_RECOVERY_ATTESTATION" \
  --launch-start "$S22_RECOVERY_LAUNCH_START" \
  --expected-gate-id "$S22_RECOVERY_GATE_ID" \
  --expected-attempt-id "$S22_RECOVERY_ATTEMPT_ID"
bun run scripts/s22-measured-broker-install-recovery.ts reconcile \
  --approval "$S22_RECOVERY_APPROVAL" \
  --approval-attestation "$S22_RECOVERY_ATTESTATION" \
  --launch-start "$S22_RECOVERY_LAUNCH_START" \
  --receipt "$S22_RECOVERY_RECEIPT"

Again, materialize the vectors from the launch publication, execute the recovery .privileged_argv no more than once, and finish only after its generated reconciliation reports a completed receipt. Inspection authority never authorizes recovery, and recovery authority never authorizes a new normal installation.

The authoritative result is the verified signed root-broker envelope over measured sealed replay. It is not campaign.json, the naked terminal marker, a marker-only verifier boolean, governance alone, a lifecycle callback, or either Matrix A.

After the root broker has published the immutable package, verify the current authority offline through the fixed root-custodied trust surface:

bun run scripts/run-s22-closure-campaign.ts verify-authority --offline

This command deliberately accepts no caller-selected publication, policy, digest, or marker path. It reads the fixed campaign trust policy, terminal intent and consumption, broker runtime and build receipts, AOT build receipt, measured policy, and publication roots, then verifies the packaged measured-request-manifest.txt. It does not reopen the original live request manifest or mutable campaign tree.

Final binding boundary

The canonical denominator is exactly 85 rows: F01–F26 plus DF01–DF59. This records 74 machine-closed and 11 machine-active rows without an aggregate closure claim. DF38 and DF56 remain active with source/runtime blockers. DF26, DF28, DF30, DF32, DF33, DF43, DF44, DF53, and DF55 are machine-active pending frozen current-source re-review before their earlier dispositions can support a new campaign. DF59 source implementation and review are closed, but its matrix and enclosing evidence remain pending. F20 exact-byte and external-Surreal evidence is stale after schema 072 and shared-adapter edits. Every matrix binding remains pending. No provisional, final, matrix, deployment, or production proof is claimed, and no matrix binding is closed merely by a source decision.

DF44’s prior initial-host probe receipt disposition is reopened for frozen current-source review: chorus.s22-initial-host-namespace-probe-build/2 never serializes the volatile /proc/sys/kernel/pid_max inode as durable authority. Each live read still retains its descriptor and requires the currently visible path to match that descriptor by device and inode before accepting the bounded value.

DF45–DF49 close the final verification-harness and resource-bound seams: packed SDK verification builds and packs an isolated staged package without mutating live distribution output; verifier setup timeouts abort and settle their process group; memory reservation retries use monotonic time plus a hard eight-attempt ceiling; deployment execution tests restore real time after every case under one finite file-local budget; and audit-source replay computes its twice-stable manifest once inside a bounded file-level setup.

DF50 separately closes the root-bootstrap approval lifetime/fingerprint seam. The root-execution bootstrap approval payload commits exact 3,600-second execution-lease and 7,200-second token-TTL policy in the canonical candidate bytes so Chorus gate creation, local fingerprinting, approval-begin attestation, and root execution bind one identical payload and fingerprint.

DF51 closes one exact ordered 38-field TypeScript/native-C measured-launch language. Missing, extra, reordered, or divergent fields fail closed before launch authority.

DF52 closes pre-measurement publication bounds and current provenance. Every such publication is bounded and binds current source, parent-generation, and runtime provenance instead of historical or caller-shaped authority.

DF53’s reboot-safe install and invocation pre-fence state machines plus the approval-bound verifier for exact resumed terminal cleanup require frozen current-source re-review before their earlier evidence can support a campaign.

DF54 closes long-expired approval observation and exact terminal cleanup/outbox parity. An observation remains non-authorizing, and only exact cleanup crosses the lease fence with in-memory, real-Surreal, public-surface, and outbox parity.

DF55’s canonical recovery-v4 producer, supervisor, native-build, staged-tree, and packaged-output provenance requires frozen current-source re-review. Its earlier candidate and descriptor-ownership evidence is non-authorizing for the edited tree.

DF56 remains active on confirmed util-linux mapping/order and tmpfs runtime blockers; its earlier descriptor/Bun evidence is non-authorizing pending repair and frozen review. DF57 and DF58 retain their intrinsic source dispositions: root preflight tracks the original operator and drains post-fork descendants without treating indeterminate settlement as authority, and cleanup/failure-publication attempts retain the primary first while surfacing cleanup-only failure. DF59 binds every supervised Linux process family to retained generation-bound pidfds for delivery, treats numeric scans as discovery-only, requires live retained family authority for acquisition, requires quiescent stable snapshots, and holds leases through bounded two-empty/all-dead settlement. All matrix and enclosing evidence remains pending. All earlier candidates, hashes, receipts, approvals, and tokens are superseded and non-authorizing.

• Run the real provisional A/B pair and retain its exact activation, evidence, and validation receipts.
• Have both provisioned reviewers sign the exact review payload and any required risk payload only after those real receipts exist.
• Replay the complete immutable provisional ancestry during the one-time governance transition, then freeze the resulting final source/governance tree.
• Run fresh final A/B from identical manifests and compare every canonical outcome.
• Require the measured worker and fixed root-broker envelope for terminal authority; a naked marker or non-authoritative broker candidate never closes a row.
• Make no post-final-B edit. Any edit reopens the final pair.

Reviewer-key provisioning and a non-authoritative broker candidate do not close a matrix row. Keep every provisional/final matrix binding pending until its signed runtime evidence and final semantic comparison actually exist.