feat(authoring): add frozen native qualification producer

[777genius]

Adds a frozen native qualification producer that consumes paired preparation artifacts without rebuilding. It checks both product journeys, installer lifecycle and preservation, closed evidence and input custody, with a read-only Linux workflow and detached preparation receipt.

Stacked on #203 at 51a9959. Seven paths, 2,638 changed lines (2,595 additions and 43 removals). The review budget excess comes from concrete independent-review fixes to the single producer/reader acceptance contract and its regression fixtures. Useful YAML capabilities and existing promotion protections remain intact.

Current head 7f545a7 corrects public info qualification to match the actual production CLI projection. Private registration roots remain validated separately; shared capture/replay checks compare public lifecycle state and package revision and reject invented private fields. Production-shaped positive journeys and subprocess/coherently rehashed replay negatives cover the earlier review defects. Scanner release archive/member binding, installed Codex documents, raw-state continuity, custody and bounded cleanup protections remain.

The enclosing public installation readback now checks mandatory fields, local source, mixed_version, needs_rebind and Go omission rules against checked registration. Unknown and private outer fields reject in both capture and coherently rehashed replay. Independent successor review accepts the enclosing comparison and the bounded reconciliation/update-eligibility corrections. Actual native execution remains unproven.

Validation: artifact SHA256SUMS, exact source hashes, patch reverse check and two-file ownership checks passed. Final focused Node tests passed 449/449; review-derived semantic and preservation probes passed 108/108, zero failures, cancellations or skips. The latest correction always requires the three reconciliation fields for targeted info and rejects update when persisted registration needs rebind or has an incompatible loader. Truthful isolated info with needs_rebind=true remains valid. Grouped-omission and impossible-update regressions cover child capture and coherently rehashed replay. Independent hosted review ACCEPTS this exact correction: 117 fresh reviewer tests passed, zero failures/skips; full source and artifact preservation verified. This is bounded source acceptance, not merge, native or release qualification. Final exact-head CI: eight required checks passed; Windows amd64 failed TestConcurrentInitAndCanceledInvocation and the dependent native/packed aggregate failed. The completed job log was read through gh API. The excluded Windows investigation was not resumed, and no root-cause or fix claim follows. The preceding 1166c0e head passed all ten required checks, which is historical evidence only. No manual rerun was issued. Positive scanner archive fixtures use a test-only pin replacement; the unmodified production reader rejects that synthetic archive. Genuine pinned archive compatibility and acquisition have not been exercised. CodeRabbit's skipped draft review is not technical acceptance.

Production whole-OS observation remains unavailable and fails closed. No actual frozen native or genuine installer journey has been accepted. This PR does not enable native admission, signing, publication or phase 7-11 gates. Full release qualification remains open.

Refs #203, #199, #208.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}