Alternatives Sequencing And Gate Semantics

Alternatives, Sequencing, And Gate Semantics

Compare a protected, mediated host controller with OS-enforced admission; an isolated disposable environment with quarantine-and-recreate rather than unsafe in-place recovery; and, if warranted, an alternative control plane. None is automatically sufficient: a separate UID alone does not protect against untrusted processes under that UID, disposable VMs can still be raced, and a different hypervisor must independently prove the same exclusion, rollback, and terminality properties. Quarantine does not authorize killing or deleting a VM whose operation is still unknown. Evaluate supported host-specific behavior, operational cost, and evidence before selecting a design; alternative software or host changes require separate approval.

1. Finish this specification and traceability; evaluate the Windows NSIS and Ubuntu lifecycle independently from control-boundary feasibility.
2. After separate implementation approval, build the bootstrap, lineage, probe, evidence, cleanup, and release verifier with offline negative tests. A cgroup experiment is a possible subtest, not the product goal.
3. After separate lab and Actions approvals, validate the chosen boundary and the component behaviors in disposable environments. A component or synthetic result is not a release qualification.
4. Freeze the complete release-candidate commit, including the gate, probe, and transition harness, then run both existing LUnit checks and all three selected lanes for that exact commit through the ordered conveyor below. A later source change creates a different candidate and requires matching proof again.
5. Before managed draft creation, tag creation, or publication, independently validate the protected lineage, cleanup, both existing LUnit conditions including their 90-day artifact limit, and all three lanes. FAIL or UNKNOWN blocks the operation. Revalidate an eligible managed draft before promotion and prove the same resolved tag target under the selected finalization policy; consumer promotion is a separate, deliberately pinned downstream decision.

ADR-0006 currently gives VM run metadata no age limit. This draft does not invent a new time limit. Qualification proves the recorded candidate worked in its recorded environment at the observed time, not that the environment is healthy now. Required authenticated proof must still be available and applicable at release time; a changed declared dependency or environment cannot be silently treated as the recorded one.