# Standalone native controller with explicit QuickFIX C++ SDK inputs

Recorded 2026-10-03. This advances the external-input and runtime archive
work in [PLAN_BENCHMARK_EXPORT.md](PLAN_BENCHMARK_EXPORT.md).

## Changes

The native controller accepts three independent local SDK paths: generated
headers, static/shared library and FIX44 dictionary. All three must be
provided together. Missing paths fail before compilation, without borrowing
the workspace's default SDK. Direct builds, skipped compilation and remote
deployment cannot use this override. Extra SDK libraries are explicit
compiler argv items. Existing fixed remote installers and their pins remain
unchanged.

An explicit SDK build fingerprints all generated headers, its library and
dictionary before/after linking; changed inputs fail. The result manifest
retains these hashes, compiler argv and executable identity. This identifies
the inputs without promoting their provenance: the portable controller
declares `unqualified-explicit-sdk`. A separate source/build receipt remains
necessary.

Runtime row creation also works without Git. An archive reports
`source-archive-unqualified`; it cannot borrow an enclosing checkout's
revision. A real checkout must have its own `.git` marker and match Git's
reported root before reporting its revision. Native CSV now retains that
same identity, which was previously present only in the JSON rows.

The [portable guide](../../bench/docs/QUICKFIX_CPP.md) provides the SDK CLI;
the [source layout](../../bench/docs/SOURCE_LAYOUT.md) describes this boundary.

## Frozen actual archive verification

The source capsule materializes **709 files** from the 706 selected files
and four template overlays (one replaces the selected README), with
`bench/` stripped. It has no `.git`, engine source directory
or development path fallback. HP consumes the
[source-built SDK](RECORD_2026-10-03_quickfix_cpp_source_sdk.md) after checking
its original source, symlinks, generated headers, library and CMake identity.
The actual exported native CLI then compiles the adapter and runs all four
flows with warmup 3, twelve measured cycles and 1,000/s offered load.

| Input | Value |
|---|---|
| Passing devel source | `fe4a760623f8db69d178b90660097f91529d38ef` |
| Stripped source fingerprint | `26ba21c916b5c47ec8e58fa3dde343361902821b0a625db78ca25bc536d0f4ed` |
| Source files | 709, unchanged after the passing check |
| Fresh SDK library SHA-256 | `93ba126bd531479aa5f503c179235ec15ee0165f85fc0fc3ebf858d742730c1a` |
| Exported adapter SHA-256 | `bc76241da34fba2e545d2e64c19f16a12b963677cb705067e0d83dda943809e2` |
| Compiler | GCC 14.2.1, C++17, `-O2 -DNDEBUG -rdynamic`, static SDK |
| Reservation | HP high-priority `isol`, CPUs 8–17, concurrent shared work permitted |

The actual CLI returns zero. All four rows retain twelve owner samples,
zero owner deficit, independent owner sinks/fold counts, two complete raw
series and bilateral admin windows with real Logon callbacks outside
measurement. Generated headers/library/dictionary match the explicit input
receipt. CSV and JSON both report the archive's unqualified controller
identity. All rows remain **`S5 diag`, `contract_status=not-audited`**; their
older shape audit cannot clear the explicit false fixture declaration.
There are zero skips and no report timing or release qualification.

## Original failed outer check

The first host generation at `720f4d6f7c22` built the same adapter and its
actual native CLI completed all four flows. Its outer checker then looked
for the controller revision in CSV, where that field was omitted, and
failed. During grading, the outer Python process also wrote bytecode into
the frozen source; the manifest's original source files were unchanged, but
six added cache files correctly caused the source-integrity check to fail.
That original controller remains failed. The next generation adds the CSV
field and disables bytecode writes in the outer process; it uses a fresh
sealed capsule and output directory.

## Evidence and remaining work

Each generation imports 48 original files plus its seal. Both retain their original controller, source and SDK manifests,
queue wrapper/journal, actual compile/run output, input receipt, CSV/JSON
reports, process logs/settings, first-cycle legacy wire dumps, admin journals
and raw series. Their import seals are additional local integrity records.
The successful controller independently checks each pair's owner and admin
proof. The older native dump covers the first warmup cycle, so it does not
substitute for the complete captures in the separate 23-pair canonical check.

- [Passing archive controller](evidence/quickfix-cpp-sdk-layout-20261003/hp-fe4a760623f8/build-report.json)
- [Explicit SDK/native result manifest](evidence/quickfix-cpp-sdk-layout-20261003/hp-fe4a760623f8/native-output/results/stage5_native_manifest.json)
- [Actual native CSV](evidence/quickfix-cpp-sdk-layout-20261003/hp-fe4a760623f8/native-output/results/stage5_native_summary.csv)
- [Original failed outer check](evidence/quickfix-cpp-sdk-layout-20261003/hp-720f4d6f7c22/build-report.json)
- [Passing import seal](evidence/quickfix-cpp-sdk-layout-20261003/hp-fe4a760623f8/SHA256SUMS)

This verifies one static-SDK standalone controller path. Other engines'
standalone inputs, public SDK/release admission, full body wire alignment,
root deployment and physical/report gates remain open. Draft export
readiness still reports 541 scrub findings in 86 files, 95 textual escapes
and zero dead links; no manifest release verification or public export was
performed.