# Explicit pinned NexusFIX SDK from a complete benchmark archive

The native full-session controller accepts `--nexusfix-source` or
`NEXUSFIX_SOURCE`, independently of the result workspace. Explicit SDK inputs
must match the committed SHA256 map of all 91 include files at upstream revision
`ffa8b0a014b5cb4020ec8a99fe22fa3a24bfc494`. The map was generated directly from
the clean managed reference's Git blobs. Missing, extra or modified headers
fail before compilation. Supplied CMake/LICENSE files are checked too; a Git
checkout additionally requires its own root, exact revision and clean status.
An unpacked archive uses the header map without borrowing parent Git metadata.

Local compilation binds the SDK, adapter/common/compatibility header inputs,
actual compiler argv and binary hash in a sidecar receipt. Reuse requires those
bytes and the receipt to match. Explicit remote builds verify their staged SDK
headers before and after compilation, leave them unpatched, and require fresh
compilation. Historical workspace diagnostics retain their previous defaults.
The [portable SDK guide](../../bench/docs/NEXUSFIX.md) and source-layout guidance
describe the inputs and remaining qualification gates. SDK code remains external.

## HP archive execution

Source **`3fa0ba913dbd476ac5a8106e92d7c8acc92cb8e2`** is preserved on
`s/codex-fullbench-nexusfix-sdk-archive-source-20261003`. The complete draft
manifest materializes **723 files** at a flat harness root, with no `.git`,
`engine/`, `internal/` or development `bench/` prefix. The separate SDK capsule
holds the 91 exact upstream include files. No files from the microbench session's
frozen runtime or SDK are used or changed.

After status/process/memory checks, HP runs the actual portable controller
under a high-priority `isol` CPU lease, with concurrent shared work permitted.
The controller uses Clang 21, its declared direct C++23/O3 build, the exact SDK
header archive and the existing compatibility header. The build and adapter
self-test pass. All four actual TCP flows retain 12/12 measured samples after
five warmups, with exact independent owner sinks/fold counts and no skips.
Their dated manifest and identical latest alias declare
`source-archive-unqualified`; contract admission stays `not-audited`.
The bound binary hash is
`64f31c4d2b25500cb11f3a5c691a018cb77a5d1de70018f202dd81610165a7bd`.

The original outer checker incorrectly expected one JSON manifest and also
named the wrong row identity field. Its first assertion stopped after the
successful controller run; the original failed JSON/log/checker remains
unchanged. A separate read-only continuation verifies the dated/latest alias,
actual `controller_revision`, all four owner/raw receipts, valid bound reuse,
rejection of a changed binary and patched SDK, and rejection of a missing
explicit SDK before workspace creation. The invalid environment SDK is
overridden by the actual CLI input. An enclosing Git directory is not borrowed.

The continuation initially queued on shared CPUs. Only that session's queued
request was dequeued; the continuation then acquired the free isolated pool at
high priority, allowing the existing shared suite to continue. No benchmark,
build or timing was rerun and no other job was altered. The original checker
failure retains its failed grade. All **723 harness files** and **91 SDK headers**
remain unchanged, including after integration with the newly published Stage 2
matrix and the other sessions' engine changes.

Local SDK/source/config/DAC checks pass **103 checks**, with zero skips, and the
source comprehensiveness gate passes. Readiness selects **720 files (9.6 MB)**,
with **205 scrub findings in 58 files**, **82 textual escapes** and zero dead
documentation links. The remaining source/runtime, licensing, wire-format,
production capture, prepared timing, admin/delay, physical rate/stability and
public release gates remain open. These receipts grant no export or Stage 5
admission.

[Original controller/checker, corrected continuation, source/SDK/binary input
receipts and raw samples](evidence/nexusfix-sdk-archive-20261003/hp-3fa0ba913dbd/SHA256SUMS).