R12 EFC Process-Custody Preregistration

Status: consumed. The repaired externally timed rehearsal passed the macOS CPU custody/mechanics gate under exact NIST pulse 1,873,055. Linux and all neural/reasoning claims remain unadmitted. See R12_EFC_PROCESS_CUSTODY_RESULT.md.

This document does not authorize a neural fit, a GPU job, a reasoning claim, or continuation pretraining.

Protected base: Shohin step 300,000 remains immutable at SHA-256 211d6b2cddf0c2cf8b12cb0b2d73f9c4440d85f6f531018080c8afd35b2f66a6. No code in this gate loads or writes that checkpoint.

Question

Can one frozen candidate compiler receive only public world evidence, compile the exact 1,536-byte EFC machine in a default-deny process, exit, and only then be assessed against a secret expected machine that was never visible to the candidate?

This is a custody question. Exact compilation by the deterministic CPU candidate is not evidence that a neural model learned to reason.

Consumed Attempt Ledger

Exact chain-2 pulse 1,873,040 at 2026-07-24T04:40:00.000Z was consumed under authorization commit c10d28f. Snapshot payload SHA-256 was 776799d658e0469431605463b7ed6f76984a653140af24e56483093aae7636d8. The run rejected before candidate launch because the relative CLI spelling of the fixed authorization path reached Git-blob verification without absolute normalization. No output root or report was published. This attempt is void, the old authorization is retired, and its pulse may not be reused. The source fix resolves and repository-bounds the path before both fixed-path and Git blob checks; a relative-path Git regression is mandatory before the next source freeze.

The repaired source was frozen at root b6c8ae3ec00fcc4f98dc696491acb5e31de798f26583024ab8292da8dac01042 under authorization commit aff33d48c670be24fb69d2cf89e1010ab27c29eb. Public GitHub PushEvent 15682040576 preceded exact chain-2 pulse 1,873,055 by 406 seconds. The macOS run passed all gates: 3/3 candidates compiled byte-identical 1,536-byte machines, later assessors and the parent agreed exactly, and the blindness probe passed. Final report SHA-256 is f2c4cd16a246f5d5da7116512601d4705ba21c14e23c582cdd95d50265450c04.

Frozen Source Languages

The same independently generated finite world is rendered three ways:

1. canonical JSON transition and observation events;
2. strict line-oriented transition and observation records; and
3. a closed cycle/program language whose actions are canonical disjoint-cycle programs and whose observers are answer-labelled state partitions.

The third language is structurally different from the first two. It declares complete algebraic programs rather than serializing event rows. All three must compile to byte-identical deployed machines. Malformed, noncanonical, partial, duplicate, out-of-range, and renderer-forged inputs fail closed.

Process Roles

Candidate compiler

The candidate role is a standalone standard-library program. Its fresh invocation directory initially contains exactly:

evidence.bin

It may create exactly:

machine.bin
candidate_receipt.json

It cannot import the Shohin repository. The expected machine, latent world, beacon snapshot, checkpoint, assessor code, and other source-language renderings are not present in its invocation directory.

Assessor

The assessor starts only after the candidate process has exited. Its fresh invocation directory initially contains exactly:

candidate_machine.bin
expected_machine.bin

It validates the complete fixed-width machine header, masks, dimensions, padding, and self-hash before reporting exact byte equality. A valid but different machine must produce a clean negative assessment rather than a parser failure.

Blindness probe

An unmocked role under the same policy must demonstrate:

• allowed input read succeeds;
• local write succeeds;
• secret-file read is blocked;
• secret-directory listing is blocked;
• repository read is blocked;
• outside write is blocked; and
• network socket use is blocked.

On macOS the frozen v1 policy uses /usr/bin/sandbox-exec, a default-deny Seatbelt profile, an exact root-owned Python runtime, one exact role script, and one writable invocation directory. Repository directories receive metadata traversal only; no repository subtree content grant exists.

Linux is not admitted by inference from the macOS result. A Linux claim requires a separate unmocked Bubblewrap network-namespace plus Landlock replay on Newton. The Linux launcher must use root-owned, non-group/world-writable Bubblewrap and Python executables, copy the Git-frozen role and Landlock sources into the isolated root, run Python with -I -S, and bind the hashes of those exact copies into every role receipt.

Source Freeze And Future Pulse

The exact source file hashes are reduced to one candidate_source_root in artifacts/r12/efc_process_custody_authorization_v1.json. The authorization and source must be committed and published at origin before beacon consumption.

The authorization freezes one exact future chain-2 pulse index and the exact lowercase SHA-512 digest of the NIST certificate DER before publication. The only admitted pulse rule is:

exact precommitted chain-2 pulse index, whose timestamp is at least 60 seconds
after GitHub's public PushEvent timestamp for the exact authorization commit

The runner verifies:

• canonical snapshot encoding;
• both consecutive NIST RSA pulse signatures;
• the certificate identifier, its equality to the precommitted DER digest, and equality with the certificate independently fetched from NIST's official HTTPS certificate endpoint;
• output hash;
• previous-output link;
• previous-pulse precommitment reveal;
• frozen chain and pulse identity;
• candidate source-root equality;
• clean local worktree;
• local HEAD equality with the published branch at origin; and
• byte equality between every frozen local source, its HEAD blob, and the exact copied sandbox role;
• byte equality between the fixed authorization path and its HEAD blob;
• a public GitHub PushEvent whose branch and head equal the published authorization commit; and
• the minimum public-PushEvent-to-pulse delay.

The GitHub event is an externally hosted, server-stamped HTTPS publication receipt, not a cryptographic RFC 3161 timestamp. The report preserves its event ID, created_at, reference, and HTTP response date. Absence, lag, or ambiguity fails closed.

The pulse output and frozen candidate source root seed one independently generated world. World admission inspects mechanics only and receives no challenge, candidate prediction, or answer.

Acceptance Gates

All gates must pass in one atomic report:

1. three candidate processes start and exit cleanly;
2. every candidate starts with exactly one public evidence file;
3. no candidate input receipt names the expected machine;
4. all three candidate outputs are valid 1,536-byte machines;
5. the parent independently recomputes each complete byte comparison and agrees with the later assessor's hashes, verdict, and exit code;
6. all three machine byte strings are identical;
7. every assessor starts after its candidate exits;
8. the blindness probe passes every check;
9. the independent world passes all frozen mechanics-admission checks;
10. the fixed authorization blob is present at published HEAD, its pinned certificate matches, and the NIST pulse satisfies the frozen future rule;
11. the report accounts for every file present before final-report publication.

Any missing output, undeclared file, symlinked input, overlapping root, noncanonical receipt, stale source hash, unpublished commit, old pulse, sandbox failure, unexpected certificate, absent public push event, machine mismatch, assessor disagreement, nonregular artifact entry, oversized input, timeout, or source-language disagreement rejects the run.

Honest Claim Boundary

A pass supports only:

One publicly frozen deterministic compiler transformed three source languages into one exact finite machine while blinded from a later assessor secret under an externally delayed world seed.

It does not show that Shohin compiled the machine, that any learned parameters generalize, that natural-language reasoning emerged, or that continuation pretraining should start. Neural preregistration remains NO-GO until this custody mechanism is replayed cross-host and a qualified learned compiler plus matched controls is frozen.