# HP current-framework physical controller, 2026-10-14

## Status at 16:21 UTC

The new controller is implemented and its complete 25-file source selection is
staged and byte-verified on HP. Five local input-selection checks pass, zero
skips; the actual CLI help starts successfully. HP preparation is queued
high/shared behind another owner's conformance run. **No new physical pair or
timing result is available.**

The earlier [terminal repair](RECORD_2026-10-14_hp-llfix-current-framework-onload-payload.md)
has now passed its independent HP qualification: three checks, zero skips,
09:21:45–09:21:46 UTC. The detached owned-PTY checks confirm echo restoration on
success and failure. The actual repaired home wrapper's check-only path and all
six staged inputs pass. Its receipt still observed the root payload absent;
fresh read-only observations at 16:10 and 16:21 UTC also find it absent.

The pending orchestration verifies an existing installation or attempts only the
previously requested fixed installer with `sudo -n`. A refusal is recorded and
ends the job before native work; no password is read by the orchestration. The
user can still complete `~/install-llfix-current-framework.sh` in an HP terminal.
No running session, service or other queue was changed.

## New context, unchanged physical methods

Source generation: `91f43030c9f9f567e058aeaa80b8280b92fc19fc`, retained on
`s/codex-llfix-reference-hp-current-physical-source-20261014`.

New `framework_controls/run_current_onload.py` binds the separately staged
`llfix-reference-hp-framework-v2-8312e4a3164b` payload to the existing physical
controller. The original `run.py` remains unchanged, with SHA-256
`49235c99da02fd58d204d8de8607a9718ec155ed4e59ad0c02e0de3a2906c3c4`.
Only its context-loader function is rebound. The pair, capture, audit, matrix,
functional-proof and host-policy functions remain the original function objects.

The context retains client CPU17/plain and server CPU16/rx16, upstream llfix
1.0.7 and the original peer, field/owner checks, socket/native identity proof,
bilateral physical counter gates, raw/extrema checks, balanced repetition,
activity refusal and bounded lossless retention. It selects only the previously
qualified fresh `e94546c8...` framework sender. The older installed manifest and
helpers remain independently verified inputs; they cannot supply a fallback
framework binary or output root.

Preparation pin:
`30aa46b6ac75e73029a1ff196b7664409fede6772833a46119a4010368d56f12`.
New protected manifest pin:
`b1de4ac5aec7c6f0ba84737e21ec7e6f84154ddf61fe1338f08c8701905c995f`.
The sealed preparation verifier runs in a fresh interpreter to prevent archived
helper module names from shadowing its imports. Missing installation is refused
before the legacy context loader or native work. Its installed-input check
grants no timing, physical, vendor, Stage2 or historical-grade admission.

Five local controls check exact new owner/output/binary binding; pending and
promoted proof refusal; wrong sender/peer, old output, altered placement/profile
and extra paced-arm refusal; preservation of measurement-function identities;
and the original controller's exact source hash.

## Frozen HP work

Capsule:
`~/build/codex-llfix-reference/libhft/hp-current-physical-20261014-ops43`.
Runtime preparation:
`~/build/codex-llfix-reference/libhft/onload-current-framework-20261014-v2`.
New campaign root: `captures/current-physical43` beneath that runtime.

The capsule contains 28 files: 25 selected source/fixture inputs and three
operational controls. All input bytes are validated before root creation. The
bounded compressed argument contains 22 source inputs; three explicitly named
larger inputs are read locally on HP and hash/size-checked before staging:
the read-only main checkout's Stage2 launcher and the existing preparation and
manifest fixtures. They match the source-generation Git blobs exactly. This is
an explicit verified copy, with no ancestor checkout discovery or mutable SDK
fallback. The complete selection is rechecked by each queued phase.

At 16:20:51 UTC the detached driver started with PID4135865/start223993947. Its
high/shared preparation waiter is PID4135866, request
`3d4c192088424fb4919c39d6021056df`, waiting behind the normal/shared conformance
owner since 13:50:05 UTC. The queue carries complete staged inputs and needs no
live SSH stdin stream.

If preparation and root checks pass, the driver proceeds serially:

1. High-priority `isol`, shared work allowed: one functional original/upstream/
   monotonic matrix, three process pairs, one million measured samples and 1000
   warmup orders per pair. Concurrent shared work is permitted for this
   functional proof; it grants no quiet timing grade.
2. High-priority `shared`: the existing independent wire/owner/socket/raw/counter
   audit of those original captures.

Every nonzero phase stops the sequence and keeps its logs and receipt. Only the
functional and audit phases are queued; the timing/capture phase is absent.
Host policy, IRQbalance, turbo, clocks, shared framework headers, SDK sources,
old runtime generations and historical results remain unchanged. Only HP was
contacted.

## Retained status and source evidence

The compact [evidence index](evidence/hp-llfix-current-physical-controller-20261014/selected-files.json)
binds 14 files/50,787 bytes: the completed HP terminal qualification and logs,
controller staging/source inventory, exact operational worker/driver/launcher,
local launch controls and a separate complete 25-file source readback. This
small read-only metadata collection starts no native work or installer and
claims no host CPU slot. Full source bytes remain in the named private Git pin
and the immutable HP capsule; no ELF or raw samples are copied into Git.

The received compressed metadata container is retained locally at
`~/archive/libhft/codex-llfix-reference-20261014/hp-current-physical-metadata45.tar.gz`;
its digest and size are in the index. Later functional outputs require their own
sealed retention and independent grading before this record can claim a pass.

## Completed HP preparation, 16:23:14 UTC

The queued preparation ran. All five controller checks pass on HP, zero skips;
the actual capsule CLI help passes and its missing-installation negative control
refuses before creating the requested campaign directory. The exact captured
source is unchanged.

The fixed non-interactive installer attempt then returned
`sudo: a password is required` (exit1). The driver records
`root-install-refused`, `authentication_required=true`, zero native pairs, and
ends with preparation exit3. Neither functional nor audit work was queued after
this refusal. The root payload remains absent; no new physical/timing result or
grade is claimed. The earlier `sudo -n -l <command>` permission listing did not
establish password-free execution.

The next required action is to finish
`~/install-llfix-current-framework.sh` in an HP terminal, entering the user's
sudo password there. The repaired wrapper handles terminal input without
recording the password. Subsequent validation must use a new continuation and
fresh receipt/log names; the original worker's preparation must not be rerun
over this failed receipt. The existing source capsule and runtime inputs can
be reused after their hashes and installed ownership/modes verify again.

The seven completed preparation/driver/log files are appended under
`completed43` in the evidence index, with all recorded log hashes checked.
Original waiting/source observations and this authentication refusal are both
retained. No session-owned host job or queue remains after the driver stopped.