L01-07 — Admit exact-SHA Core qualification

[mberrys]

Outcome

Collect Linux/Windows source, test, independent oracle, installed runtime, and candidate artifact identities for this module.

Parent and boundary

Parent: #2. Owner: LoopLibCore. This issue owns one bounded slice of Evidence Core; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Acceptance

• Every required L01 lane passed on the selected SHA with no qualifying skip; deviations have explicit disposition.
• Failure case: PR merge or green aggregate without inspected lane details does not close the module.

Required proof

Candidate dossier linked from parent with SHA, runs, artifact digests, and reviewer decision. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap.

[mberrys]

L01-07 qualification record: admission deferred to the L01 closeout

This is the qualification record for this issue. It follows the checklist in docs/CORE_QUALIFICATION.md. Admission is not granted in this train. This issue is the last of the L01 set, and it is closed out on the second half of the merge, which carries the remainder of L01.

Candidate

Field	Record
Candidate	84f1f84451a1961b2de76b5977f8af210fc43356 (the L01 gap-closure head on the unstable promotion line)
Comparison base	846e8694 (stable, the version the promotion targets)
Qualification ref	L01-GAPS
Catalog digests	architecture-catalog.json cfce8290a035aa36888949bd55d0446113ef8b2206e6907d8b47ac7688c8b3f0, preflight-check-catalog.json 0c1f3d09734a1d09250c907855aa89cff869b2bb5ed6569fc3a6e9051299ee46, preflight-coverage-backlog.json cd14a670282ce888a89187641ac0d127ec4d71c2e104bde91efd0f0ca5d6914f, preflight-corpus-coverage.json aec3acc671cf8ccb5611e2977b03b1268b5eb4fdf09adca9bbad230ffe65ee91

The candidate is a moving target: the L01 children below are still landing, so any later head invalidates this record. A rerun against a different SHA is a different record.

Child acceptance

Issue	Acceptance state at this candidate	Disposition
#15	Accepted. docs/EVIDENCE_CORE_RESET_INVENTORY.md is re-pinned to 4388ca36, the stale backlog digest is corrected, all eighteen open backlog rows name their live tracker, and a review record is present. python scripts/generate-architecture-catalogs.py --check exits 0.	Accepted
#16	Implementation is merged (b9caa53e); the issue closes with the promotion pull request #155, not with a candidate packet.	Accepted as implemented, closure pending on #155
#17	Accepted. Producer and result fencing merged (626ce488, d297f8e5); this candidate adds the missing fault-injection tests in UnitTests/tst_editorhosttest.cpp (snapshot identity faults for document revision, document key, operation, kind and recipe, plus a worker success with no admitted outcome failing closed). Hosted execution is run 36810615939.	Accepted
#18	Not accepted. The branch codex/issue-18-independent-claims is in flight and no independent oracle result exists for this candidate. The mapped scripts/ci/check_independent_validation_gate.py is a presence and self-certification guard, not an oracle result.	Blocking
#19	Accepted as implemented (be4edcd4, d7eeebb7, c9af5df2, f8b46038, 648d160b, 04ead25a, 14264ad6, 8a789dd9, 0f10c873); strict matrix run 36782669570 succeeded on 4388ca36.	Accepted as implemented, closure pending on #155
#20	Partially accepted. Containment is merged (4bcd75de, 67ef0685, 173a156a); the audit's twelve in-process routes are verified and re-dispositioned as reviewed deferrals excluded from untrusted-content admission; the hosted Linux lane executed the isolation suite on run 36782268622 (58 of 58 owning tests passed, UnitTestsPdfWorkerIsolation 121.60 s). Hosted Windows execution of that suite is run 36810615939 and was still running when this record was written. The installed-product dump and telemetry channels are not qualified.	Blocking on the hosted Windows and installed-product lanes
#113, #114, #115, #116, #117, #118, #119, #120	Not accepted. Pull requests #156, #157, #158, #159, #160 and #161 are open against dev for #114 to #120, and #113 and #117 have no pull request yet. No accepted regression fixtures or before/after reports exist for this candidate.	Blocking

Lanes

Field	Record
Source and tests	Hosted Linux full build and test: run 36810615939 (workflow_dispatch, ref L01-GAPS, head 84f1f844). Hosted Windows full build and test: same run, windows / build. Status when this record was written: the Linux job failed before any build started, because vcpkg could not download libuuid-1.0.3.tar.gz from SourceForge (HTTP 522 on every mirror), and it is queued for a rerun; the Windows job was still running. Earlier hosted Linux evidence for the containment sources: run 36782268622 at 173a156a, agent-fast / build on ubuntu-24.04, 58 of 58 tests passed with UnitTestsPdfWorkerIsolation at 121.60 s and no skipped test.
Independent claims	None for this candidate. #18 is open and the installed validators were not run against candidate output bytes.
Resources and isolation	#19 strict envelope matrix: run 36782669570 on 4388ca36. Worker isolation: the Linux lane above. Windows isolation on this candidate: run 36810615939.
Installed runtime	None. LinuxInstall.yml and WindowsInstall.yml were not dispatched with source_sha=84f1f844, so no AppImage or MSI exists for this candidate and the package-boundary provenance checker was not run against one.
Artifacts	None. No package artifact, byte count, SHA-256 or retention window can be recorded without the package lanes.
Local evidence	No local native execution was possible: this worktree has no configured build directory. scripts/agent/check-change.py reports every source-level check as passing (changelog, source_integrity, architecture_catalog, policy_adapters, preflight_truth_source, qml_mirror_parity, search_budget_gate, independent_validation_gate, architecture_contracts, qt_test_runtime, and format:UnitTests/tst_editorhosttest.cpp) and every build, focused-test and clang-tidy check as unavailable. That result is incomplete, so it is not proof.

Deviations

Limitation	Owner	Evidence	Disposition
#18 independent claims are absent	Core qualification	#18 open, branch in flight	Qualifying. Gates the L01 closeout.
#113 to #120 acceptance is absent	Core preflight	Pull requests #156 to #161 open, #113 and #117 unfiled	Qualifying. Gates the L01 closeout.
No installed-package lanes for the candidate	Release qualification	No source_sha=84f1f844 package run	Qualifying. Gates the L01 closeout.
Hosted Windows isolation result not yet inspected	PdfTool	Run 36810615939, windows / build in progress at record time	Qualifying until inspected. A Windows skip or failure blocks the L01 closeout, not this train.
Twelve in-process parse routes stay excluded from untrusted admission	PdfTool and Core	docs/PDF_WORKER_ISOLATION_AUDIT.md, verified with path and line references	Non-qualifying for this module: the exclusion is deliberate and the isolated open/preflight route is the only admitted path. It stays a recorded limitation.
Dump and telemetry collection channels	Release qualification	Host machine policy and captured artifacts inspected on the Windows qualification host; hosted-runner and installed-product policy not inspected	Qualifying for the installed-product claim, non-qualifying for the isolated worker route, whose own dump suppression is source-verified.

Decision

Field	Record
Decision	Admission is not granted in this train. This issue is the last of the L01 set. It is closed out on the second half of the merge, which carries the remainder of L01.
Reviewer	The repository owner (mberrys). This record is the agent review prepared for that decision; the owner's acceptance or reversal is recorded on pull request #155.
Candidate	84f1f84451a1961b2de76b5977f8af210fc43356
Remaining risk	#18's independent claims and the #113 to #120 acceptance evidence do not exist for this candidate, and no installed package was built from it. Those are the L01 remainder, so they gate the closeout rather than this train.

Next step for admission: land #113 to #120 and #18, freeze a new candidate SHA, dispatch full CI, Linux_AppImage and Windows_MSI with that source_sha, run scripts/qualification/check_core_qualification.py against the downloaded evidence, and replace this record with the reviewer's admission decision on the second half of the merge.