R1B Phase 1A.1: production interlock evidence seal (non-final, stacked on Phase 0)

[AnubisQuantumCipher]

Non-final stacked PR on Phase 0 (r1b/phase0-unified-truth). Fake-substrate plus measured grant preparation only. No real SMAppService.register / .unregister. No live migration. Apple public distribution membership unresolved. Do not merge.

Hermes counterfinding (why 1A.1 exists)

Hermes independently reproduced the Phase 1A 17/31/63/64 gates, probe build, draft PR identity, and hosted macOS 14/15 CI. The public probe then reached permit using:

• bundle SHA-256 of sixty-four zeroes;
• source commit hard-coded to the old Phase 0 commit;
• usedNonces: [];
• foreignOverlap: false;
• sacrificialExists: true.

The Phase 1A fake harness is real. The claim “ready for Phase 1B after authorization alone” is not.

What 1A.1 seals

• Measured running-executable SHA-256 (CryptoKit, file bytes) and compiled 40-hex build commit (scripts/build-probe.sh refuses a dirty tree unless --identity-commit is injected for a hermetic test).
• Authorization file opened once (lstat + regular file + owner + mode ≤ 0600 + 4096-byte cap + O_RDONLY|O_NOFOLLOW). Bytes are never re-read by path.
• Two immediately adjacent root/authority observations via the live read-only provider. Fixture env is ignored on that path. Missing personal-mover plists mean that mover is not installed; an existing-but-unreadable plist refuses.
• Durable O_CREAT|O_EXCL nonce under the authorized sacrificial support root. Replay and concurrent duplicates refuse. A→B→A: docs/evidence/R1B_PHASE1A1_ABA_NONCE_EXCLUSIVITY.md.
• Sealed PreparedMutationGrant plus append-only pre-call record. The public probe prints GRANT_PREPARED / STOP_BEFORE_PRODUCTION_ADAPTER and exits 4. Construction/call ledger is zero. Production adapter methods return fail-closed and do not call SMAppService.register.
• Retained second-precall A→B→A: docs/evidence/R1B_PHASE1A_ABA_SECOND_PRECALL.md (S11/S12).

Gates

--self-test 17/17; --r0-test 31/31; --state-test 63/63; --phase1a-test 64/64; --phase1a1-test 24/24; public-boundary 30/30.

Out of scope / still required for Phase 1B

A reviewed minimal patch connecting the sealed grant to exactly one production adapter call, plus separate architect authorization. Token creation must use the measured probe executable hash and the compiled final source commit. Runtime label, Login Items string, status semantics, FDA/TCC, reboot/login, and Apple distribution remain unknown.

No launchctl mutation, Login Items, FDA, live Desktop movement, personal-mover mutation, merge, tag, release, notarize, or Homebrew.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 92675c6c-48d2-4d05-9f8c-a241b2028010

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}