Genesis ceremony runtime — 2026-09-12

Frozen Genesis ceremony runtime consumed by scripts/bundle-eidolon-runtime.mjs, pinned by name and SHA-256. Not a Cipher release: install Cipher from the v* releases.

Why a new runtime. The cipher-runtime-20260909 binaries were built before the commit that closes the three machine-lock holes (fail-open when the lock server is unreachable, key generated before the check, client-chosen vault number). These are built from the private core at 8a51d13, which includes that fix.

Asset	Built on	SHA-256
cipher-runtime (Linux x86_64)	Ubuntu 22.04.5, glibc 2.35, CPython 3.10.12	b54cfd522f2b1df6027412d31eabe4689be16e6c6396d8aac6c99d3f5315a83d
cipher-runtime.exe (Windows x64)	Windows 11, CPython 3.12.14	62b1b7232e23c801871491fb09ed0fe27735fa36065b8709cc55eb04b4f03fdd

Measured glibc floor of the Linux binary: 2.35 (Ubuntu 22.04+, Debian 12+). Executes on glibc 2.35 and 2.39.

Verified under confinement on both platforms, against a local fake lock server and a throwaway data dir, never against production:

Course	Result
A. lock server unreachable	exit 2, REFUSED, no .psnx written, no lock file
B. lock server present	exit 0, min_entropy_bits 768, one .psnx, .machine_lock.enc armed, two signed requests (status, register)
C. second ceremony, same machine	exit 2, REFUSED (machine_lock), no additional .psnx

Verify a download with sha256sum -c SHA256SUMS.