ci(track-a): advance current official client fence

[blakinio]

Objective

Advance only the Track A current official native-Linux runtime identity fence to the independently proven current public package, while preserving all historical exact-build evidence and fail-closed safety boundaries.

Task: OTC-20260819-track-a-current-client-fence-advance

Proven current package

Fresh direct public-package verification on Synology independently reproduced:

packed_size: 10214529
packed_sha256: 1fc26d66cef90723d29293f177fcff41c8e937e7aac830f08e82c2f4c69eb354
unpacked_size: 52109920
unpacked_sha256: ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8
elf_build_id: d803d9695868713ef6ab0c3cf65f91212c9c6a62
embedded_version_token: 15.32
raw_client_retained: false

The unpacked size/SHA matches the unique live Kasm client fenced by Draft PR #550 and the separately audited current-package identity in PR #544.

Governance change

Current runtime identity becomes:

version_token: 15.32
size: 52109920
sha256: ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8

The superseded 15.32.df7b29 / 51965216 / e6c244bd... corpus remains valid historical build-fenced evidence only. This PR does not rewrite historical S1/S9 evidence and does not modify tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json.

Historical addresses, offsets, QMeta/vptr assumptions, serializers, helper binaries and ABI profiles are not promoted to the new binary.

Enforcement synchronization

The same current identity is synchronized across:

• TIBIA_RESEARCH_TRACKS.md policy v6;
• Track A runtime admission;
• canonical bootstrap/Gate-B contract and ADR;
• canonical live-session and transition enforcement scripts;
• deterministic Track A governance validator/workflow;
• parallel research coordination/prompt snapshot (1.0.1) plus prompt regression cases.

Safety / non-effects

This is repository-only governance work (runtime_access: none, mutation_authorized: false). It grants no login, credential, GUI input, gameplay, process-control, transaction or other mutation authority. Normal ownership, admission, Gate A/rebind/Gate B/bootstrap rules remain unchanged.

Per repository trust rules, this unmerged change cannot expand the current economy runtime task's authority. Even after merge, PR #550 must re-read trusted main and re-admit in a later invocation before using the new fence.

Local validation

git diff --check = PASS
Track A branch-bound admission audit = PASS
TRACK_A_AGENT_RUNTIME_CHANGED_TASKS=1
TRACK_A_AGENT_RUNTIME_BRANCH_BOUND_TASKS=1
TRACK_A_AGENT_RUNTIME_GOVERNANCE_PASS=true
Python py_compile = PASS
normalized shell syntax = PASS
workflow YAML parse = PASS
historical tibia-15.32.df7b29 runtime-bridge profile unchanged = PASS
changed files = exactly 15 declared task/governance/evidence paths

Remaining gates

• exact-head GitHub CI / Track A governance;
• fresh independent post-implementation audit with zero open material findings;
• current-main freshness / clean PR diff and review-thread check;
• only then Ready + protected squash merge.

[blakinio]

Fresh independent deterministic post-implementation audit on exact head 6519449943cf676d9d5c23eee4faa6b2f23d08f1.

Validator context:

validator_role: fresh_final_deterministic_falsifier
fresh_detached_worktree: true
trust_worker_summary: false
implementation_authorized: false
runtime_mutation: false
raw_proprietary_client_retained: false

Independent checks, all PASS:

• exact PR diff = 15 declared governance/task/evidence paths only;
• git diff --check;
• branch-bound Track A admission: TRACK_A_AGENT_RUNTIME_CHANGED_TASKS=1, TRACK_A_AGENT_RUNTIME_BRANCH_BOUND_TASKS=1, TRACK_A_AGENT_RUNTIME_GOVERNANCE_PASS=true;
• modified Python compile, normalized shell syntax, workflow YAML parse;
• tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json has the exact same Git blob on base and head;
• no binary/proprietary-client file in the PR diff;
• public current Linux package was freshly fetched and independently decoded again: packed 10214529 / 1fc26d66cef90723d29293f177fcff41c8e937e7aac830f08e82c2f4c69eb354, unpacked 52109920 / ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8, ELF build ID d803d9695868713ef6ab0c3cf65f91212c9c6a62, embedded 15.32 token;
• current size/SHA are synchronized across tracks, admission, bootstrap, ADR and executable canonical enforcement;
• historical SHA is absent from active transition/session enforcement and retained explicitly as historical evidence in governance prose;
• prompt contract/eval revision 1.0.1 contains F01-F05 current/historical/mismatch/stale-ABI/no-authority regression cases;
• added-line scan found no concrete login_authorized:true, credential/input/gameplay/process-control/transaction authority, or mutation_authorized:true;
• fail-closed wording scan found no new hash/Gate bypass or mismatch allowance;
• task remains runtime_access:none, mutation_authorized:false, physical_e2e_required:false, and explicitly forbids using this governance change to expand #550 in the same invocation.

Result:

FINAL_AUDITED_HEAD: 6519449943cf676d9d5c23eee4faa6b2f23d08f1
INDEPENDENT_AUDIT_RESULT: PASS
MATERIAL_FINDINGS_OPEN: 0

This audit validates the current-runtime identity-fence change only. It does not promote historical offsets/helpers/ABI assumptions and does not itself authorize any live action.

[blakinio]

Fresh exact-final-head independent deterministic audit on 6b2162ca7afca1d95c711756d680a633c5e0fcfe.

Validator context:

validator_role: fresh_exact_final_deterministic_falsifier
fresh_detached_worktree: true
trust_worker_summary: false
implementation_authorized: false
runtime_mutation: false

Exact-final checks all PASS:

• diff scope = exactly 15 declared governance/task/evidence paths;
• branch-bound Track A admission and static governance PASS;
• Python compile, normalized shell syntax, YAML parse, git diff --check PASS;
• no binary diff;
• historical tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json blob unchanged;
• official current Linux package independently fetched and decoded again: packed 10214529 / 1fc26d66cef90723d29293f177fcff41c8e937e7aac830f08e82c2f4c69eb354, unpacked 52109920 / ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8, ELF build ID d803d9695868713ef6ab0c3cf65f91212c9c6a62, embedded version token 15.32;
• current identity synchronized across tracks/admission/bootstrap/ADR and canonical transition/session enforcement;
• old SHA absent from active transition/session enforcement but retained explicitly as historical evidence;
• prompt contract/eval 1.0.1 has F01-F05 regression cases;
• no added concrete login/credential/GUI/gameplay/process-control/transaction/mutation authority;
• fail-closed scan found no new hash/Gate bypass or mismatch allowance;
• prose hygiene correction verified (Current research fence:; changelog item under ## Unreleased; task EOF newline present);
• task still explicitly states that this governance change cannot be used to expand PR #550 in the same invocation.

Result:

EXACT_FINAL_AUDITED_HEAD: 6b2162ca7afca1d95c711756d680a633c5e0fcfe
INDEPENDENT_AUDIT_RESULT: PASS
MATERIAL_FINDINGS_OPEN: 0

No live action, credential use, login, input, transaction, process control or proprietary-binary retention occurred in this audit.

[blakinio]

Terminal exact-head CI checkpoint for 6b2162ca7afca1d95c711756d680a633c5e0fcfe.

terminal_ci_wait_started_at: 2026-08-19T09:35:00+02:00
ci_check_generation: draft
terminal_ci_checks_for_current_generation: 1
terminal_ci_wait_budget_minutes: 21
unchanged_pending_gate: CI run 32228123889 / Fast Checks / Informational static analysis / Install analysis dependencies
non_ci_gates_complete: true
exact_final_independent_audit_review: 4969512522
exact_final_independent_audit_result: PASS
material_findings_open: 0
track_a_agent_runtime_governance: 32228120002 SUCCESS
track_a_canonical_live_governance: 32228123685 SUCCESS
track_a_xres_identity_repair: 32228123209 SUCCESS
review_threads: 0
main_at_wait_start: 82e5f435c3aa4172115bf7f6a0cd7a5cc6da3d50
auto_merge_configured: false
reason_auto_merge_not_configured: PR remains Draft until normal readiness/required-CI gate is satisfied
next_action: recheck this exact CI generation after the contract minimum poll interval; if CI / Required succeeds, verify unchanged head/main/review state, mark Ready, observe any new required generation, then protected squash-merge

No CI rerun/cancel/bypass is being performed while the job is still in progress.

[blakinio]

Fresh independent post-restack audit on exact head 1f06f6a36683f3a1c5e92570439e89854b7876b5, base main@cf90b84442dda730bdab93d8aa9f3236b7532ad8.

Result: PASS; open material findings: 0.

Fresh detached-worktree falsifier (worker summary not trusted, implementation not authorized) independently verified:

• merge base equals current trusted main;
• exactly 15 declared changed paths; git diff --check PASS;
• branch-bound Track A admission/governance PASS (CHANGED_TASKS=1, BRANCH_BOUND_TASKS=1);
• canonical governance YAML parses;
• historical tools/tibia_runtime_bridge/profiles/tibia-15.32.df7b29.json blob unchanged;
• no binary diff;
• current canonical enforcement requires 15.32 / 52109920 / ed5469b9... and contains no superseded current-enforcement fence;
• added diff introduces no login/credential/gui-input/gameplay/transaction/process-control/mutation authorization set true;
• task remains runtime_access: none, mutation_authorized: false;
• prompt regression cases F01-F05 are present.

Primary package provenance was independently re-fetched again from the current official public Linux client.lzma and decoded without retaining raw bytes: packed size 10214529, packed SHA256 1fc26d66cef90723d29293f177fcff41c8e937e7aac830f08e82c2f4c69eb354; unpacked size 52109920, SHA256 ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8; ELF build ID d803d9695868713ef6ab0c3cf65f91212c9c6a62; Last-Modified Tue, 18 Aug 2026 08:22:05 GMT; raw client retained=false.

A preliminary stage-3 invocation was explicitly discarded because PowerShell malformed the git diff range; the corrected rerun used ${base}...HEAD, checked the external exit code, and produced the PASS above. This review relies only on the corrected rerun.