Enforce qualified pidfs host and process broker contracts

support/external-tools.toml

@@ -1,6 +1,57 @@
-schema = 1
+schema = 2
 levels = ["V1", "V2", "V3", "V4", "V5"]
 
+[pidfs_host_support]
+id = "pidfs-process-identity-v1"
+platform = "linux-x86_64"
+minimum_kernel = "6.9"
+probe = "pidfs-host-support-probe-v1"
+qualification_ids = ["upstream-linux-6.9.0-x86_64"]
+runtime_failure_policy = "fail-before-generation"
+verifier_unavailable_policy = "skip"
+bounded_claim = "current-boot-smoke-only"
+diagnostic_platform = "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64."
+diagnostic_kernel = "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport."
+diagnostic_qualification = "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record."
+diagnostic_smoke = "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created."
+
+[[host_probe]]
+id = "pidfs-host-support-probe-v1"
+owner = "IP-03"
+cache_key = "boot_id"
+result_claim = "bounded-current-boot-observations"
+attempts_per_step = 1
+step_timeout_ms = 5000
+total_timeout_ms = 60000
+cleanup_timeout_ms = 5000
+steps = [
+    "linux-x86_64-kernel-floor",
+    "pidfd-operations",
+    "pidfs-magic",
+    "concurrent-same-process-identity",
+    "last-close-live-reopen-identity",
+    "simultaneous-process-distinct-inode",
+    "stale-handle-cannot-affect-live-peer",
+    "exit-reap-drop-all-later-process-non-reuse",
+]
+
+[[kernel_qualification]]
+id = "upstream-linux-6.9.0-x86_64"
+kind = "upstream"
+architecture = "x86_64"
+release = "6.9.0"
+source_ref = "v6.9"
+source_commit = "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6"
+source_archive_sha256 = "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149"
+source_signer_fingerprint = "647F28654894E3BD457199BE38DBBDC86092693E"
+build_config_sha256 = "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a"
+build_image_sha256 = "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc"
+probe_binary_sha256 = "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f"
+reuse_result_sha256 = "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f"
+acquisition_result_sha256 = "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3"
+pidfs_inode_semantics = "boot-monotonic-u64"
+status = "qualified"
+
 [[command]]
 id = "python"
 program = "python3"
@@ -83,6 +134,15 @@ policy = "skip"
 levels = ["V2", "V3", "V4", "V5"]
 diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
 
+[[command]]
+id = "strace"
+program = "strace"
+args = ["--version"]
+version_pattern = '^strace -- version [6-9]\.|^strace -- version [1-9][0-9]\.'
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases."
+
 [[feature]]
 id = "linux-x86_64"
 probe = "linux-x86_64"
@@ -93,10 +153,18 @@ diagnostic = "Physical and composition suites currently support Linux x86_64."
 [[feature]]
 id = "kernel"
 probe = "kernel-at-least"
-minimum = "6.8"
+minimum = "6.9"
 policy = "skip"
 levels = ["V2", "V3", "V4", "V5"]
-diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
+diagnostic = "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity."
+
+[[feature]]
+id = "pidfs-host-support"
+probe = "registered-host-support"
+contract = "pidfs-process-identity-v1"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record."
 
 [[feature]]
 id = "user-namespaces"