R12 EFC Process-Custody Result

Date: 2026-07-24
Protocol: efc-signed-process-rehearsal-v1
Decision: PASS on macOS CPU custody mechanics; Linux and neural claims remain unadmitted.

This result does not authorize a neural fit, a GPU job, continuation pretraining, or a Shohin reasoning claim.

Question

Can one publicly frozen deterministic compiler receive only public evidence, compile the exact 1,536-byte EFC machine in a default-deny process, exit, and only then be assessed against a secret expected machine that was never visible to the candidate?

For the exact macOS protocol below, the answer is yes.

Retired Attempt

The first externally timed attempt used authorization commit c10d28f and NIST chain-2 pulse 1,873,040. It rejected before candidate launch because a relative CLI authorization path was not normalized before Git-blob lookup. No artifact root, candidate, assessor, or report was published. That attempt is void and its pulse is retired.

The repair:

• resolves the fixed authorization path once before validation;
• repository-bounds every Git-blob path;
• includes a direct relative-path regression; and
• passes the complete frozen EFC suite, 195/195, plus Ruff and py_compile.

The repair source was committed and published as e594575.

External Timing And Source Freeze

The runner independently fetched the certificate from the official NIST HTTPS endpoint and verified both the target and immediately preceding RSA signatures, target output hash, previous-output link, previous precommitment reveal, exact chain/index/timestamp, certificate identifier, authorization pin, published origin head, frozen Git blobs, and the matching public GitHub event.

Candidate And Assessor Result

One independently generated admissible world was rendered in three distinct source languages:

Each source was handled by a fresh candidate process whose initial directory contained only evidence.bin. Each candidate exited with code zero and produced only machine.bin and candidate_receipt.json. The expected machine was not in any candidate directory.

Only after each candidate exited did a fresh assessor process receive the candidate and expected machines. All three assessors exited with code zero, and the parent independently recomputed complete byte equality rather than trusting assessor booleans.

Blindness And Artifact Gates

The unmocked macOS /usr/bin/sandbox-exec probe under the same frozen default-deny policy passed every gate:

• allowed input read;
• local output write;
• secret-file read blocked;
• secret-directory listing blocked;
• repository content read blocked;
• outside write blocked; and
• network socket blocked with a policy-specific denial.

All candidate and assessor roles ran with sandbox enforcement, exact hash-bound role source, -I -S, closed input/output file sets, zero stderr, zero stdout, and zero exit status. The world admission checks passed transition completeness, bijection, noncommutativity, observer shape, nontrivial empty-observation partition, and full future separation while inspecting zero query fields.

The atomic artifact contains 27 pre-report regular files, no symlinks, no undeclared temporary root, and a complete content map:

The local post-run verifier independently recomputed all 27 file hashes, file-map root, authorization and snapshot hashes, frozen source root, target and predecessor NIST verification, origin head, 406-second publication separation, role exits, sandbox flags, candidate blindness, assessor order, and all three complete machine equalities.

An independent hostile post-run audit found no P0, P1, or P2 loopholes for the narrow macOS CPU custody-mechanics claim and returned PASS / FREEZE. It independently extracted all 13 frozen source blobs from authorization commit aff33d48c670be24fb69d2cf89e1010ab27c29eb, replayed the generator and all three compilers, verified all twelve persisted machine copies and their internal self-hashes, and repeated the NIST and artifact verification.

Local artifact:

artifacts/r12/episode_functor_process_custody_1873055

Claim Boundary

This pass supports only:

One publicly frozen deterministic compiler transformed three source languages into one exact finite machine while blinded from a later assessor secret under an externally delayed world seed and an unmocked macOS default-deny process boundary.

It does not establish:

• a learned source-to-machine compiler;
• Shohin ownership of the compiled machine;
• natural-language grounding;
• unseen-world or unseen-task neural generalization;
• architecture-native autonomous execution;
• broad or general reasoning;
• Linux process custody; or
• any reason to resume continuation pretraining.

The local process and timing receipts are also not hardware attestation. They assume the host administrator and operating-system trust base are not malicious, and they do not claim crash-durable publication.

Next Gate

1. Replay the role boundary unmocked on Linux with root-owned Bubblewrap, network-namespace isolation, and Landlock when Newton is reachable.
2. Freeze a separate learned compiler preregistration with unseen worlds, held-out renderers, post-seal challenges, source deletion, exact machine scoring, capacity-matched cache controls, generic-recurrence controls, and key/transition causal interventions.
3. Run any learned first fit in isolation from the protected step-300k checkpoint. The user hold on continuation pretraining remains absolute.