schema = 2
levels = ["V1", "V2", "V3", "V4", "V5"]

[pidfs_host_support]
id = "pidfs-process-identity-v1"
platform = "linux-x86_64"
minimum_kernel = "6.9"
probe = "pidfs-host-support-probe-v1"
qualification_ids = ["upstream-linux-6.9.0-x86_64"]
runtime_failure_policy = "fail-before-generation"
verifier_unavailable_policy = "skip"
bounded_claim = "current-boot-smoke-only"
diagnostic_platform = "LZ-HOST-PIDFS-PLATFORM: PidfsProcessIdentityV1 requires Linux x86-64."
diagnostic_kernel = "LZ-HOST-PIDFS-KERNEL: PidfsProcessIdentityV1 requires Linux x86-64 kernel 6.9 or newer; Linux 6.8 is unsupported even with a partial pidfs backport."
diagnostic_qualification = "LZ-HOST-PIDFS-QUALIFICATION: the running kernel build has no exact qualified source/build record."
diagnostic_smoke = "LZ-HOST-PIDFS-SMOKE: the bounded per-boot pidfs support smoke failed; no runtime resource or durable generation may be created."

[[host_probe]]
id = "pidfs-host-support-probe-v1"
owner = "IP-03"
cache_key = "boot_id"
result_claim = "bounded-current-boot-observations"
attempts_per_step = 1
step_timeout_ms = 5000
total_timeout_ms = 60000
cleanup_timeout_ms = 5000
steps = [
    "linux-x86_64-kernel-floor",
    "pidfd-operations",
    "pidfs-magic",
    "concurrent-same-process-identity",
    "last-close-live-reopen-identity",
    "simultaneous-process-distinct-inode",
    "stale-handle-cannot-affect-live-peer",
    "exit-reap-drop-all-later-process-non-reuse",
]

[[kernel_qualification]]
id = "upstream-linux-6.9.0-x86_64"
kind = "upstream"
architecture = "x86_64"
release = "6.9.0"
source_ref = "v6.9"
source_commit = "a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6"
source_archive_sha256 = "24fa01fb989c7a3e28453f117799168713766e119c5381dac30115f18f268149"
source_signer_fingerprint = "647F28654894E3BD457199BE38DBBDC86092693E"
build_config_sha256 = "7db4d48deb650052df60273c7f2c2d228c981db4d6f76b8eb929a9e120d7283a"
build_image_sha256 = "e85edb5da3dc18295f05baeb38ff019a6621c1cac2e6ac81b99e14450c72d7fc"
probe_binary_sha256 = "040a84f2b06ae73671c262016c649fe21e3fb21fad89cea3d6d76f8d7436648f"
reuse_result_sha256 = "b8491adc9c0fd4509ec94a99d03835842f7f92ca6d5baad8f6589a7f3c49517f"
acquisition_result_sha256 = "867492f65ffd473733544626c032957143f40d040e1a4e8e1e82bf9e4bca6cc3"
pidfs_inode_semantics = "boot-monotonic-u64"
status = "qualified"

[[command]]
id = "python"
program = "python3"
args = ["--version"]
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Python 3.11 or newer is required for repository verification."

[[command]]
id = "rustc"
program = "rustc"
args = ["--version"]
version_pattern = '^rustc 1\.90\.0 '
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."

[[command]]
id = "cargo"
program = "cargo"
args = ["--version"]
version_pattern = '^cargo 1\.90\.0 '
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."

[[command]]
id = "cargo-deny"
program = "cargo-deny"
args = ["--version"]
version_pattern = '^cargo-deny 0\.20\.2$'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."

[[command]]
id = "git"
program = "git"
args = ["--version"]
version_pattern = '^git version 2\.'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Git 2.x is required for generated-file drift checks."

[[command]]
id = "tlc"
program = "tlc"
args = ["-h"]
version_pattern = 'Version 2\.19 '
accepted_exit_codes = [0, 1]
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the TLC 2.19 launcher on PATH."

[[command]]
id = "runsc"
program = "runsc"
args = ["--version"]
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
policy = "skip"
levels = ["V3", "V4", "V5"]
diagnostic = "The selected composition is qualified on runsc release-20260622.0."

[[command]]
id = "fuse-overlayfs"
program = "fuse-overlayfs"
args = ["--version"]
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."

[[command]]
id = "slirp4netns"
program = "slirp4netns"
args = ["--version"]
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."

[[command]]
id = "strace"
program = "strace"
args = ["--version"]
version_pattern = '^strace -- version [6-9]\.|^strace -- version [1-9][0-9]\.'
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Install strace 6.x or newer to run the registered final-binary exercised-path syscall cases."

[[feature]]
id = "linux-x86_64"
probe = "linux-x86_64"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Physical and composition suites currently support Linux x86_64."

[[feature]]
id = "kernel"
probe = "kernel-at-least"
minimum = "6.9"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Linux x86-64 kernel 6.9 or newer is required; Linux 6.8 is unsupported for pidfs process identity."

[[feature]]
id = "pidfs-host-support"
probe = "registered-host-support"
contract = "pidfs-process-identity-v1"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "PidfsHostSupportProbe execution is owned by IP-03; this scaffold cannot claim host support from a version string or manifest record."

[[feature]]
id = "user-namespaces"
probe = "user-namespace"
program = "unshare"
sysctl_path = "/proc/sys/user/max_user_namespaces"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."

[[feature]]
id = "subordinate-ids"
probe = "subordinate-ids"
minimum_count = 65536
uidmap_program = "newuidmap"
gidmap_program = "newgidmap"
unshare_program = "unshare"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."

[[feature]]
id = "fuse-device"
probe = "open-character-device"
path = "/dev/fuse"
access = "read-write"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."