# HP current-framework Onload payload, 2026-10-14

## Status and next action

The new payload is **staged and checked, awaiting root installation**. No root
copy, benchmark socket, native pair or timing measurement ran in this step.

On HP, run:

```sh
~/install-llfix-current-framework.sh
```

It takes a high-priority shared host CPU slot, checks all fixed inputs, and
requests terminal sudo authentication for the reviewed installer. It creates
`/usr/local/libexec/llfix-reference-hp-framework-v2-8312e4a3164b` and two
privilege-dropping launchers. Existing versioned destinations are never
overwritten. A later invocation verifies an already installed generation.
`--check` performs only the corresponding staged/installed checks.

The older load-v1 payload, all four of its native binaries, its manifest and
four launchers remain unchanged. The new generation needs its own physical
functional proof before any quiet timing campaign. Prior diagnostic rankings
and activity rejections retain their original grades.

## Inputs and scope

Producer source: `fda7579d91491e06d1ef2bb5bf8413d89dab04d6`.

The fresh sender comes from the independently completed
[current-framework qualification](RECORD_2026-10-13_hp-llfix-current-framework.md):
four localhost pairs, 806 matching orders per peer, 770 measured samples,
13 Python checks and seven native allocation cases. Its framework source is
frozen at `d598c4336b8fdcfe2bb5c045c1378a8fa076820d`; this does not qualify later
framework edits.

| New installed name | SHA-256 | Origin |
| --- | --- | --- |
| `original_tx` | `8003c3734c257c5e76f9a226f542c42d544ca52c83ef1401bec78ff4f09fabd5` | Unchanged protected upstream sender |
| `framework_tx` | `e94546c82dd0d0792d129c6ac2aa63b05ad6437454ca8d413ac1dd7db49686bd` | Fresh qualified framework sender |
| `tx_peer` | `9f7a2379b99da6c7df7216f276bde074c30b72de0d27fcae902cb278677f1cf4` | Unchanged protected peer |

Preparation rechecks the three exact qualification documents, all 18 frozen
source files, eight framework headers, 522 compiler dependencies, the compiler,
all 204 unpatched llfix 1.0.7 files, the cold audit and its capture binding.
There is no rebuild or new SDK patch. The baseline protected manifest remains
`78abcf4109fa5c0b29c96feeb5656bd507caae15fa6a3e842135b7e36c9b4b17`.

Placement remains client CPU17 and server CPU16 on HP's sfcA/sfcB Solarflare
DAC. The fixed profile choice remains client `plain` and receiver `rx16`
(`EF_POLL_USEC=-1`, `EF_TCP_RCVBUF=1048576`). Both launchers are preserved byte
for byte except their single `SETTINGS` assignment. They retain clean transport
environments, namespace and native identity checks, and privilege drop before
native execution. No paced sender is selected or freshly qualified here.

The new installer uses the unchanged reviewed `prepare_pinned.installer`
function. Its producer file remains
`f774eca4bd845a6890c8f9efc0cb3ffaee38587c0a32b1e50405e26a9ccd2542`.
All old protected inputs and every new input are checked before destination
creation. ELF/data remain outside the namespace sudo wildcard; only the two
fixed launchers enter its protected directory. No sudoers, service, IRQ,
turbo, governor, network buffer or other host policy is changed.

## Verification and retained evidence

Local: ten existing physical admission/refusal checks and five new producer
checks pass, zero skips. HP: the same five new checks pass from the frozen
source capsule; actual preparation, staged check, launcher/installer syntax checks
and the home script's check-only path pass. New checks cover altered/incomplete
proofs, source coverage and binary identity, false promotion, symlink/byte/mode
refusal, unchanged launcher executable AST and input refusal before root writes.

The HP preparation queued high/shared behind another owner's exclusive Rust
job. It ran at 07:39:49–07:39:50 UTC and started zero native pairs. Home-script
verification and archival operations also used high/shared slots. No other
owner's job, queue or service was modified; only HP was contacted.

Active preparation:
`~/build/codex-llfix-reference/libhft/onload-current-framework-20261014-v2`.
Frozen capsule:
`~/build/codex-llfix-reference/libhft/hp-current-onload-20261014-ops36`.
Keep both until installation and subsequent consumer qualification finish.

Installer SHA-256:
`4d73655ef6cfdeadf079ba067e9b742064b9fa6172dd6ab232b2a0693df87077`.
Home-script SHA-256:
`8f97ceb98fde995787120ea66ec54e62f5a098a9b012f77d39f4c35fdd8adb67`.

The complete compressed archive is retained on HP and BEELINK2 under
`~/archive/libhft/codex-llfix-reference-20261014/`:

- `hp-current-onload-payload-v2-20261014.tar.gz`: 35 named files,
  1,401,459 logical bytes, 503,451 compressed bytes. SHA-256
  `ec7e52eabbc523d8dbd2627fb9b858897505054e6b387e5087a8fb36b4f9de4d`.
- Its `.seal.json`: SHA-256
  `5bd90e62045186e5e147cd3bd0692e4952a41e4abdde921a02934d230ff1b153`.

Both copies independently verify every file's bytes, size and mode. The complete
archive retains the three native ELFs and the prior qualification documents;
these are excluded from this compact Git selection. The original sealed inputs,
archives and active preparation remain in place; no cleanup was needed.

The compact [evidence index](evidence/hp-llfix-current-onload-payload-20261014/selected-files.json)
binds the reviewed sources, both generated launchers, installer, home script,
checks, metadata and archival controls. All timing, physical, vendor, Stage2
and historical-grade promotion flags remain false.

## Home-wrapper terminal repair, 08:35 UTC

The user reported `a terminal is required` when the original home script reached
sudo. HP's installed `host-cpu-slot.supervise` uses `start_new_session=True`:
the child inherits the terminal on stdin but loses its controlling terminal.
Ordinary sudo tries the latter for password input. This prompt path was missing
from the original check-only qualification.

The home wrapper now uses `/usr/bin/sudo -S` with a strict `isatty(stdin)` shell
guard. Only sudo reads the password. Terminal echo is explicitly disabled during
the call and restored on success, failure and handled interruption. A caller
without a terminal is refused before queuing and is told to use
`ssh -t hp ~/install-llfix-current-framework.sh`. The command and fixed installer
hash remain unchanged; no password is stored, read by a test, or sent to logs.

Applied home-script SHA-256:
`586d3d7b2b1ae8aa99644fbca39303af71be9f391bb811d4e71ed6a1183a0845`.
This supersedes only the original home-wrapper hash above. The sealed payload,
installer, source capsule, previous wrapper and original archive remain intact.
Repair source is retained at `52d7a3b98045eb0b1449110193ee00c0872e64db`.

Three local checks pass, zero skips: exact limited wrapper delta and syntax;
non-terminal refusal before queuing; and actual PTYs already owned by a login
session, followed by detached children. The latter executes a harmless sudo
substitute, verifies no controlling terminal and disabled echo, and checks echo
restoration for both success and failure. An unowned PTY would let bash acquire
a controlling terminal and would miss this reported failure.

The first HP repair qualification was refused by the CPU helper before staging
because the user's manual installer retry was already queued ahead of it.
That refusal is retained. At 08:35:18 UTC, only the home wrapper was atomically
replaced, after checking the original bytes and preserving them. The user's
existing queue was neither stopped nor reordered: it will read the corrected
wrapper when its slot opens. No build, test, sudo or root installation ran in
this filesystem-only replacement.

Independent HP tests and staged/installed input checks are queued high/shared
behind that user retry as `llfix-current-framework-terminal-qualification42`,
PID3512934/start221207220, at 08:36:23 UTC. At publication their result is pending;
no HP pass or successful root installation is inferred from local tests.
The compact [repair evidence](evidence/hp-llfix-current-onload-tty-20261014/selected-files.json)
retains both wrapper versions, exact source, local PTY results, the original
helper refusal, atomic-replacement receipt and independent queue launch.

Follow-up: the queued HP terminal qualification completed at 09:21:46 UTC with
all three checks passing, zero skips; staged inputs and the repaired home
wrapper also pass. Root installation was still absent. The exact completed
receipt/logs and subsequent controller preparation are retained in
[the current physical-controller record](RECORD_2026-10-14_hp-llfix-current-physical-controller.md).