test(bazel): qualify stock Engine fixture supplement

Test-only stock Engine fixture supplement; not a product release.

The isolated producer supplies exactly ContainerUnixHTTPServer, NIOWebSocket and CNIOSHA1. All five published stock product archives, locks and recipes are reused unchanged. The import-only consumer executes all 110 stock Engine cases freshly, with zero failures, errors or skips. The successful attempt reuses compiled outputs: 50 producer disk-cache hits and three consumer disk-cache hits; one fresh test action runs.

Executed source: 98b6819. Its controller falsely rejected Bazel's one-based shard identity after the native suite passed. Corrected validator source: 987f3eb. A separately reviewed recovery processor authenticates retained source/configuration, configured graphs, build/test events, five product archives, exact binary delta, fresh XML/log, owned-server cleanup and host restoration before sealing this supplement. No fourth native run, unchanged baseline rebuild or historical benchmark rerun was performed. The original failed controller receipt and raw evidence remain preserved in evidence.zip.

Assets contain the binary supplement, raw evidence, provenance receipt, 110-case JUnit result and exact recovery processor. The provenance distinguishes executed and validator revisions. This supplement is test-only and does not replace any product dependency. It does not establish coverage, live Docker parity, performance parity, newest-stack integration, notarization or full product qualification. Broader gates remain open.

perf(compose): record complete frozen timing matrix

Complete frozen 26-workload Compose timing evidence; diagnostic prerelease, not a product release.

All 130 candidate observations pass their original contracts and below-10x timing guard. This release adds only 20 new startup/teardown observations for one and ten services. The 110 published logging observations and all 260 historical Docker/original-fork rows are reused unchanged. No baseline was rebuilt or rerun. No binary was rebuilt or duplicated.

One-service startup median is 4.82 times recorded Docker and 7.65% slower than the original fork; ten-service startup is 2.78 times Docker and 4.26% slower. Ten-service teardown is 1.34 times Docker and 0.71% faster; one-service teardown is 0.99 times Docker and essentially unchanged. The full matrix records every ordinary regression and improvement.

Reuse the exact signed Compose archive from candidate-output-performance-e2aa25f05997-ba07cf8d6891, asset632379131, SHA256ba07cf8d68917aa46dba008144350fe9e47ded4b92f86ea4adfc5e12963c304c. Matching runtime source641b7019ce11735e75b331e32a777a130439e9f3 remains in candidate-output-performance-b89eecd3379b-f7da9cbca159, asset632285749, SHA256d7b159a1f3abc238a1060944270553f0992e88ceec8426aea06cf6d1c5cb0b23. These diagnostic binaries are signed but not notarized.

Assets contain all130candidate timing rows, all260historical reference rows, comparisons, derived130-case JUnit timing evidence, raw lifecycle logs/fixtures/restoration receipts, exact processors and immutable binary/evidence references. The prior1,318enhanced Core cases and separately published110stock Engine cases are reused as scoped evidence; the stock supplement is test-only and preserves its original controller failure and subsequent authenticated correction.

Five historical observations per fixture are diagnostic, not simultaneous paired measurements. P95 is the maximum of five observations. Lifecycle proves its original command-success contract, not broader CRUD semantics. Passing the timing guard is not performance parity. Newest-stack integration, complete live parity, measured overall coverage and notarized product qualification remain open. All owned resources and previous runtime/host/Colima registrations were restored. The pre-existing failed Homebrew API service remains a separate condition; restoration does not claim repaired service health.

perf(logging): qualify full logging diagnostic candidate

Full logging diagnostic candidate; not a fully qualified product release.

All 110 observations across the 22 frozen logging workloads passed their original output/delivery/cache/rotation assertions and the diagnostic timing guard. The corrected optimized enhanced Core and temporary-file suites pass all 1,318 cases. The original compiler-crash evidence is retained. Stock Engine tests remain blocked before execution by a missing test-only server dependency closure; they are not reported as passed.

Median 1-MiB stdout command time improved 26.6% against the recorded original fork, but is slower than the earlier focused b89 candidate. Some workloads are slower than the original fork: attached startup is +14.7% and remains 6.34 times the recorded Docker reference. The included comparison table shows every workload without an aggregate score.

Assets contain the exact signed Compose candidate, all 110 raw timing rows, semantic assertions, original historical fork/Docker samples, the earlier 15 focused candidate samples, unit proof and source/dependency provenance. Unchanged baselines were neither rebuilt nor rerun. All five published lower archives were reused. The matching unchanged Container runtime archive is reused from candidate-output-performance-b89eecd3379b-f7da9cbca159 (asset 632285749, SHA256 d7b159a1f3abc238a1060944270553f0992e88ceec8426aea06cf6d1c5cb0b23); it is not redundantly uploaded here.

These five-sample historical comparisons are diagnostic, not simultaneous paired measurements or proof of a renderer-only speedup. Four lifecycle timing workloads, newest-stack integration, complete stack parity, stock Engine test-support qualification and notarized product release remain pending. Passing the 10x timing guard is not performance parity. The signed diagnostic archive is not notarized.

Cleanup restored the previous runtime, original registrations and Colima configuration. The original installed Homebrew API service was already failing before the run; restoring its registration did not repair that pre-existing failure. A descriptive memory-scope correction in provenance is supported by the unchanged authenticated aggregate fixtures; all raw fingerprints and measurements are preserved.

perf(logging): diagnostic candidate with faster stdout output

Focused performance candidate, not a fully qualified product release.

All 15 trials passed the original lifecycle/logging workloads. Median stdout throughput command time improved 33.4% against the recorded prior fork, while remote delivery (+0.11%) and cached reads (+0.97%) were effectively unchanged. The stdout median is still 3.90 times the recorded Docker reference.

The assets contain the exact signed Compose candidate, matched patched Container runtime, 15 raw timing rows, semantic assertions, historical baseline rows and source/dependency provenance. The unchanged published baseline was neither rebuilt nor rerun. The Container client SDK was independently published as layer-container-sdk-enhanced-66d87a93c4747679463f; other client lower archives and the guest were reused.

These are five-sample historical comparisons, not simultaneous paired measurements or proof that the renderer alone caused the improvement. Full Core, full logging/stack parity, newest-stack integration and notarized product release remain pending. These signed diagnostic archives are not notarized.

Cleanup restored the previous runtime, original registrations and Colima configuration. The original installed Homebrew API service was already failing before the run; restoring its registration did not repair that pre-existing failure.

container-compose parity and performance evidence (2026-10-08–09)

This supplementary evidence release records the fresh Container Compose campaign; it does not replace the 0.16.0 GA release or claim full Docker performance parity.

• 66 parity checks and 27 native runtime tests passed.
• 28 fresh comparison timings passed, compared with 28 reused published reference timings under the original 8-GiB profile.
• The separate 4-GiB profile completed all 260 timings across 26 fixtures at 1 and 10 services.
• Three 50-service fixtures have 30 timings still unmeasured: the unchanged 200-MiB guest-cap guard refused admission. The original capture had 5.556 GiB available versus 9.328 GiB required; the final read-only recheck still had only 6.123 GiB. These are pending samples, not timing passes.

The measured candidate source is 1ef7a07fc27f1f9b65b3aa88e9df1a5de98c29a0; native runtime test artifact source is 5a60352febdbd2db04216c65b9b60443b1bf5d39. The signed Compose executable and normalizer are retained byte-for-byte in the measured-payload asset with a SHA-256 manifest. The later native inventory maintenance fix at a370072e47fbb76ac19d1199a03019e1e21fa65f was applied after timing ended; it does not relabel measured inputs.

All lanes and host state were restored. Original failed receipts remain unchanged, including the 50-service producer's incorrect restoration field; actual restoration is independently proven by retained cleanup, original-profile and outer-restoration receipts. Raw logs, configurations, host observations and secrets are excluded. Historical references remain reused published assets; this snapshot does not rebuild or remeasure the old version.

Container Compose 0.16.0

Container Compose 0.16.0 is the enhanced layered Bazel release at source 5a60352. It consumes the existing qualified runtime and compiled dependency releases without rebuilding them.

The exact product passed 27 runtime tests, all 66 parity cases and 28 measured benchmark samples, with complete host restoration. The published historical Docker benchmark reference was reused. Benchmark measurements and provenance are included as release assets; they do not claim general Docker performance parity.

Both Compose executables are signed and the final ZIP is Apple-notarized. Full source companions, third-party notices and reviewed distribution closure are included. The paired Container distribution is version 0.16.0 while its unchanged qualified runtime executable retains embedded version 0.0.0 at source f86fea2236fab118c0e0c6f8be5eb7672df894e2. The runtime archive and executable bytes are unchanged.

Stable promotion follows real GitHub download verification, installation/tests of both Homebrew formulas, baseline restoration and publication of the tested formula pair. Release tooling: #712 . Product layering: #708 .

Stock Compose gateway layer 96289f31c102

Signed and notarized arm64 stock Compose Engine gateway compiled from 96289f31c102105c77b414d631a439075d5540b7, consuming five published stock SDK layers. The stock unit, provider and coverage stages passed. Apple notarization b4bb06e8-af1b-4ae0-aaa1-7e48e179901b was Accepted.

The runtime readiness fix validates the explicitly selected Engine endpoint and underlying provider rather than requiring an unrelated globally registered Engine. Strict live CLI/API identity and capability checks remain enforced. The provenance asset binds the exact source, profile, dependency locks, signed payload tree, archive checksum and notarization. This prerelease is an external Devcontainer qualification input. Runtime qualification is pending and distribution readiness remains false.

Stock Compose gateway 79b3c929

Signed and notarized arm64 stock Compose Engine gateway compiled from 79b3c92930a64fa151b856f2254db8d16825661d, consuming five published stock SDK layers. Stock provider, unit and coverage gates passed, with 90.981% selected unit/CLI coverage. Apple notarization 542ed290-49b6-4229-b4fd-dc61a1edecc1 was Accepted.

Repeated creation reuses only the exact compatible owned network, and repeated deletion accepts only confirmed absence. Foreign, ambiguous, malformed or unavailable inventories remain errors. The provenance binds the source, profile, dependency locks, signed tree, archive and notarization. This prerelease is an external Devcontainer qualification input; runtime qualification is pending and distribution readiness remains false.

Stock Compose gateway 5a60352f

Signed and notarized arm64 stock Compose Engine gateway compiled from 5a60352febdbd2db04216c65b9b60443b1bf5d39, consuming five published stock SDK layers. Stock provider, unit and coverage gates passed, with 90.9812% selected unit/CLI coverage. Apple notarization 653a01fa-3d60-48d3-a5e7-c86fed964341 was Accepted.

Network reuse preserves stable project, logical network, working-directory, custom-label and internal-network ownership when generated configuration-file provenance changes. Repeated volume deletion accepts HTTP 404 only after current inventory proves the exact name absent; other errors remain errors. Provenance binds source, profile, published dependency locks, signed payload, archive and notarization. This prerelease is an external Devcontainer qualification input; runtime qualification is pending and distribution readiness remains false.

Stock Compose gateway 57ee265a5fbd

Signed and notarized arm64 stock Compose Engine gateway compiled from 57ee265a5fbd17a1109240a0d0aa99da01acfc3a, consuming five published stock SDK layers. Stock provider, unit and coverage gates passed. Apple notarization 1980ea7c-bf74-4ca5-9ee6-83a77ebd16d1 was Accepted.

Stop and delete preserve a typed missing-container response so teardown completes when the exact owned container already auto-removed. Other failures remain errors. The provenance binds the source, profile, dependency locks, signed tree, archive and notarization. This prerelease is an external Devcontainer qualification input; runtime qualification is pending and distribution readiness remains false.