commit bec47ce944f9f0663344b8ca8eae7488f1bc3448
parent 4528ed88ea666e52a2e2a81bffe57011a50c1995
Author: Ryan Sepassi <rsepassi@gmail.com>
Date: Wed, 15 Jul 2026 22:46:36 -0700
docs: record release audit resolutions
Diffstat:
1 file changed, 363 insertions(+), 56 deletions(-)
diff --git a/doc/RELEASE_AUDIT_2026_6_0.md b/doc/RELEASE_AUDIT_2026_6_0.md
@@ -1,8 +1,10 @@
# Kit 2026.6.0 black-box release audit
-Phase 1 baseline report, 2026-07-15. This report covers the immutable release
-distribution preserved at `build/audit/release-phase1/baseline/dist/kit`. It
-does not approve or begin Phase 2 functional remediation.
+Phase 1 baseline report and accepted remediation record, 2026-07-15. This
+report covers the immutable release distribution preserved at
+`build/audit/release-phase1/baseline/dist/kit`. The baseline evidence remains
+unchanged; the post-audit decisions in section 12 approve the intended Phase 2
+outcomes but do not claim that implementation has begun.
Throughout this report, `evidence/...` abbreviates
`build/audit/release-phase1/evidence/...`.
@@ -49,6 +51,16 @@ examples, runtime-header documentation, and complex-tool examples execute as
documented. The four functional candidate failures are unchanged baseline
defects, not candidate regressions.
+The post-audit review accepted a concrete resolution for every remaining
+finding. Section 12 is the implementation authority: it groups all 37 findings
+by functionality and dependency rather than severity. Nine documentation/help
+findings are already complete and 28 require implementation. The review also
+confirmed that the updater currently accepts an unsigned channel index and
+that the repository's embedded test signing key is not a production trust
+anchor. That newly inspected trust-chain defect is a release gate attached to
+the frozen baseline ID KIT-P2-007; its remediation severity is P0 even
+though the historical ID is not renamed.
+
## 2. Product contract and audit boundaries
The audited product serves C developers using the command-line toolkit and
@@ -452,7 +464,302 @@ Specificity gaps include missing `ld` input becoming an entry-symbol error,
normal table header to stdout before total failure. Misspelled commands, flags,
targets, languages, and formats do not suggest close valid values.
-## 12. Findings ledger
+## 12. Accepted remediation ledger
+
+This is the forward implementation contract. Severity remains part of each
+frozen finding ID for traceability, but it does not determine the order below.
+The workstreams are ordered by dependency, and findings appear under the
+component that should own the fix. Within a workstream, complete the numbered
+items in order unless a red-green test proves they are independent.
+
+Status terms used here are:
+
+- **Complete:** the Phase 1 documentation/help change and its acceptance tests
+ already pass.
+- **Accepted:** the resolution is approved but not yet implemented.
+- **Release gate:** the accepted work must pass before 2026.6.0 can ship.
+
+### 12.1 Distribution identity, hosted discovery, and relocation
+
+Dependency: establish one canonical distribution/executable identity first;
+SDK discovery and durable installed aliases must consume it rather than invent
+their own path rules.
+
+1. **KIT-P0-001 — canonical support discovery (accepted; release gate).**
+ Explicit `--support-dir` wins and an invalid explicit value fails without
+ fallback. Otherwise resolve the canonical running executable and probe
+ `<exe-dir>/support` for a development build, then
+ `<exe-dir>/../support` for a packaged distribution. Remove cwd and source-
+ checkout fallbacks, and expose normalized absolute paths. Cover direct,
+ PATH, installed alias, relocated, spaces, read-only, POSIX, and Windows
+ invocations.
+2. **KIT-P0-002 — native macOS SDK application (accepted; release gate).**
+ Native `cc`, `check`, `cpp`, and `build-*` compilation is hosted by default
+ on both aarch64 and x86-64 macOS. Sysroot precedence is explicit
+ `--sysroot`/`-isysroot`, then `KIT_SYSROOT`, then internal native SDK
+ discovery. Resolve it once, apply that exact root to headers and linking,
+ and make `-print-sysroot` report it. Do not borrow an SDK across operating
+ systems or depend on `xcrun`; preserve freestanding opt-outs. Direct `ld`
+ remains unhosted unless an explicit hosted request such as `-lc` requires
+ SDK-backed startup/libc resolution.
+3. **KIT-P1-013 — installed alias relocation contract (accepted).**
+ `kit install` aliases the existing binary; they are not promised to survive
+ an arbitrary later move of that binary. After a move, `kit install --force`
+ repairs them, while `kit update` owns the managed stable installation
+ layout. Adjust the relocation harness so it tests failure before repair and
+ success after repair, for POSIX symlinks and Windows hardlinks.
+
+### 12.2 Package trust, release channel, and updater semantics
+
+Dependency: expose one detached-signature verifier and trusted-key model, then
+use the same authenticated identity for the channel index and package before
+finalizing updater exit behavior.
+
+1. **KIT-P1-011 — detached Minisign verification (accepted; release gate).**
+ Add `kit pkg verify-signature [-p PUBKEY] [-x SIG] FILE`, defaulting to
+ `FILE.minisig`. With no `-p`, resolve the signature's key ID through the
+ trusted-key store; do not use TOFU because a detached Minisign signature
+ does not contain its public key. Add a public
+ `kit_pkg_verify_detached` API returning signer ID and trusted comment.
+ Interoperate in both directions with stock Minisign. Return 0 for valid, 1
+ for I/O, format, trust, or integrity failure, and 2 for usage. Keep detached
+ verification distinct from package-container verification.
+2. **KIT-P2-007 — authenticated production update channel (accepted; P0
+ release gate).** Official release builds must provide a production index
+ URL and production public key(s), must exclude the repository test key, and
+ must fail the release build if either configuration is missing or a test
+ anchor remains. Channel precedence is `--index`, environment, then the
+ compiled stable URL; development builds may omit the default. Fetch with
+ `curl` only, treat mirrors as untrusted transport, verify
+ `channel.index.minisig` before parsing the index, and apply `--key` to both
+ index and package verification. The authenticated package ID/version must
+ match the selected entry, and the running binary version is the downgrade
+ floor when no managed install exists. `--check` and `--dry-run` must not
+ persistently mutate installation state.
+3. **KIT-P1-012 — update result semantics (accepted; release gate).**
+ `update --check` returns 1 when no configuration exists or the index cannot
+ be fetched, authenticated, or validated. Return 0 only after a valid index
+ has been checked; an available update is still a successful check. Reserve
+ 2 for usage errors and test clean isolated state, fetch failure, bad index,
+ no update, and update available.
+
+### 12.3 Target authority, input compatibility, and runtime ABI
+
+Dependency: create the target-profile authority, resolve one effective target
+per operation, enforce it at the library link boundary, and use that same
+result for Android predefines, runtime selection, and RISC-V metadata.
+
+1. **KIT-P1-001 — public target-profile registry and `kit targets`
+ (accepted; release gate).** Build the command from one public registry that
+ covers all 19 audited cells plus compiled-in extras such as Wasm. Provide a
+ human table, `--format=triple`, a versioned TSV form, and detail lookup by
+ triple. Report architecture, OS, object format, hosted/libc/sysroot model,
+ and capability separately from local provisioning. Move
+ `scripts/hosted.sh` toward consuming this authority rather than duplicating
+ it.
+2. **KIT-P0-004 — link-session target compatibility (accepted; release
+ gate).** Enforce compatibility in the public/libkit link-session boundary,
+ not only the driver. Validate raw objects, in-memory builders/LTO, every
+ archive member, and DSO/import-library inputs for every output format.
+ Compare architecture, format, pointer width/endian, ABI, and platform under
+ explicit compatibility rules. An explicit `-target` is authoritative;
+ otherwise infer from the first target-bearing input and require agreement.
+ Diagnose named inputs with expected and actual properties before creating
+ output, and fold the existing freestanding-only driver checks into this
+ central path.
+3. **KIT-P1-002 — owned Android API predefine (accepted; release gate).**
+ Give hosted dynamic predefines owned context storage so
+ `__ANDROID_API__` cannot borrow a stack slice. Define the exact API integer
+ from the resolved target and cover NDK r27d NativeActivity preprocess,
+ compile, and shared link for API 21 and a later API.
+4. **KIT-P1-003 — on-demand rv32 Kit runtime (accepted; release gate).**
+ Build the needed runtime from shipped sources on demand rather than shipping
+ a matrix of prebuilt variants. Resolve the final target, `-march`, and
+ `-mabi` before runtime selection; separate soft- and hard-float cache keys.
+ Populate an atomic user cache without writing the read-only distribution or
+ invoking a host toolchain. Cover empty-cache/read-only relocation and QEMU
+ execution with i64/floating-point helpers.
+5. **KIT-P1-004 — RISC-V ABI flag merge (accepted; release gate).** Merge ELF
+ `e_flags` from all inputs in the central compatibility flow. Reject mixed
+ float ABIs with named-input diagnostics, merge RVC/features according to the
+ psABI, retain the result through relocatable and final links, and select the
+ runtime from the same effective ABI. Verify rv32/rv64 soft/hard results with
+ an independent `readelf` oracle.
+
+### 12.4 C frontend, code generation, and compiler-driver compatibility
+
+Dependency: normalize backend selection before optimizer construction, then
+extend frontend/codegen contracts, and finally broaden multi-source driver
+orchestration.
+
+1. **KIT-P0-003 — portable-C optimization normalization (accepted; release
+ gate).** Accept `--emit=c` with `-O0`, `-O1`, or `-O2` as the public contract
+ already promises, but normalize the effective Kit optimization level to O0
+ before creating an optimizer. All spellings must emit usable C and must
+ never signal; cover native and cross target selections.
+2. **KIT-P1-014 — GNU-compatible reserved `typeof` spellings (accepted).**
+ Implement `__typeof` and `__typeof__` for expression and type-name forms as
+ unevaluated operands, preserving qualifiers, arrays, function types, and
+ pointer types. Do not reserve plain `typeof` while the language mode remains
+ C11 without an explicit GNU dialect. Retain compatibility predefines and add
+ the uthash regression.
+3. **KIT-P2-001 — real stack protector modes (accepted).** Implement
+ `-fstack-protector`, `-fstack-protector-strong`,
+ `-fstack-protector-all`, and `-fno-stack-protector` in the shared native
+ pipeline at O0 and optimized levels, with conventional function selection.
+ Surface the mode through the public codegen option. Use target-ABI-correct
+ guard access and failure symbols; freestanding output may leave the guard
+ and failure hook unresolved but must never install a predictable fallback.
+ Instrument every return and prevent tail exits from bypassing the check.
+ Test symbol references, deliberate guard failure, native architectures, and
+ cJSON.
+4. **KIT-P1-015 — multi-source dependency generation (accepted).** For
+ `-M`/`-MM`, emit one rule per source in input order to stdout by default, or
+ all rules transactionally to explicit `-MF`. For `-MD`/`-MMD`, generate the
+ per-source dependency file during compile and compile-link flows. Preserve
+ independent targets/paths, correct repeated `-MT`/`-MQ` behavior and
+ escaping, and remove the single-source/`-c` restriction.
+
+### 12.5 Linked-image and object transformation
+
+Dependency: preserve primary input diagnostics, introduce a format-layer
+linked-image rewrite model, then build strip/objcopy/image behavior on it.
+Canonical linked-symbol emission is shared linker infrastructure and must not
+be hidden by presentation-layer deduplication.
+
+1. **KIT-P2-003 — binary-tool input diagnostics and stdout transactions
+ (accepted).** Preserve the first primary file failure with its exact path
+ and category; do not replace it with derived missing-entry errors. `ld`
+ loads and validates inputs before opening output. `strip` identifies
+ `input` or `archive(member)`. `size` prints its header only after the first
+ valid input; with no valid input stdout is empty. Multi-input tools may print
+ valid rows while diagnosing invalid inputs, but return 1 if any input fails.
+2. **KIT-P1-007 — strip linked executables and shared libraries (accepted;
+ release gate).** Add a libkit format-layer linked-image rewrite rather than
+ parsing or relinking in the driver. Support applicable ELF, Mach-O, and PE
+ architectures while preserving entry point, load layout/permissions, ABI
+ flags, dynamic imports/exports/relocations, TLS, unwind data, and init/fini.
+ `--strip-debug` removes only debug data; `--strip-all` also removes symbol
+ tables not needed by the loader. Preserve executable mode and write
+ transactionally for in-place and `-o` operation. Signed images fail
+ unchanged by default; explicit `--remove-signature` removes signature
+ metadata and requires later resigning. Test runnable static, dynamic, PIE,
+ and shared outputs across formats.
+3. **KIT-P1-017 — relocatable and linked raw-image conversion (accepted;
+ release gate).** For linked inputs, derive raw output from load segments;
+ for relocatable inputs, use allocated sections with contents and reject
+ unapplied relocations. Lay out by address, zero-fill gaps, and resolve
+ overlaps deterministically in favor of the later selected section. Apply
+ only/remove-section selection. Preserve section addresses in IHEX/SREC and
+ do not invent a relocatable entry point. Route ELF, Mach-O, COFF, and Wasm
+ through the image library and write transactionally.
+4. **KIT-P2-002 — image rebasing and text-address semantics (accepted).**
+ `--bias` adjusts every emitted address, including entry; SREC termination
+ and the IHEX start-linear-address record use the adjusted entry. Reject any
+ remaining address above 32 bits before writing. Limit `--base` to flat
+ formats; IHEX/SREC reject it with a `--bias` hint. Metadata records original
+ and emitted base/entry. Cover boundary, overflow, negative-bias, and
+ below/above-4-GiB cases.
+5. **KIT-P3-003 — canonical linked symbol emission (accepted).** The duplicate
+ is confirmed in the Mach-O `LC_SYMTAB` by the platform `nm`; Kit `nm` is
+ faithfully reporting a linker defect. Centralize the canonical-global
+ predicate already used by ELF and apply it to Mach-O symbol emission and
+ linker symbol reports. Recompute `LC_SYMTAB`, `LC_DYSYMTAB`, and indirect
+ indices after filtering. Preserve distinct aliases, locals, and versioned
+ symbols that legitimately share an address; do not deduplicate in `nm`.
+ Cover aarch64/x86-64 cross-object reference/definition pairs, repeated
+ imports, and same-address distinct aliases with Kit and platform oracles.
+
+### 12.6 CLI parsing, diagnostics, and utility compatibility
+
+Dependency: first share strict option/count parsing and bounded suggestion
+helpers; then implement command-specific semantics on top of uniform 0/1/2
+exit classification and transactional output.
+
+1. **KIT-P1-016 — conventional argument forms (accepted; release gate).**
+ Accept `ar rcs` and `ar -rcs`; accept raw assembler stdin as `as -` with
+ `<stdin>` diagnostics; support `--` in file-oriented tools. In the shared
+ linker parser, make `-Wl,-T,FILE,-e,SYM`, joined/equal forms,
+ `--script`/`--entry`, and equivalent `-Xlinker` sequences behave identically.
+ Cover direct and installed aliases plus paths containing spaces/dashes.
+2. **KIT-P2-008 — bounded valid-value suggestions (accepted).** Add a shared,
+ allocation-bounded, deterministic edit-distance helper that never
+ autocorrects. Use a conservative threshold, stable tie-breaking, and a small
+ result cap. Draw candidates from authoritative command, target, frontend,
+ format, and option registries; when no target is close, point to
+ `kit targets`. Preserve status 2 and stderr-only usage diagnostics.
+3. **KIT-P2-013 — structured Gram usage errors (accepted).** Return a
+ structured parse error containing category, option, and offending value.
+ Distinguish unknown option, missing option argument, invalid numeric value,
+ and duplicate/missing grammar. Print the precise error before the synopsis,
+ accept `--`, use the shared suggestion helper for unknown options, and
+ complete parsing before file reads or writes.
+4. **KIT-P1-005 — strict CPIO validation and modes (accepted; release gate).**
+ Conflicting modes return usage status 2. Corrupt/truncated archives,
+ missing trailers, unsupported patterns, and failed explicit decompression
+ return 1. Validate the full archive before extraction so failure cannot
+ leave a partially trusted tree.
+5. **KIT-P1-006 — debugger script failures (accepted; release gate).** Missing,
+ unreadable, overlong, or malformed explicit scripts return 1 in batch and
+ interactive modes. Distinguish an explicit quit from an error and never
+ convert a script failure into a successful REPL fallback.
+6. **KIT-P2-011 — checksum verification and `cmp` option spellings
+ (accepted).** Add `-c`/`--check` manifests for `sha256sum` and Kit's
+ BLAKE2b-256 `b2sum`, including stdin, standard hex/mode/filename syntax,
+ exact digest-width validation, `OK`/`FAILED`, quiet, and status-only modes.
+ Diagnose GNU BLAKE2b-512 manifests as incompatible rather than silently
+ changing Kit's BLAKE2b-256 contract. Reject the manifest/payload dual-stdin
+ conflict and reuse the generic hash path; `crc32` remains digest-only. A
+ checksum check returns 0 when every entry passes, 1 for mismatch, unreadable
+ input, or malformed manifest, and 2 for usage. For `cmp`, add
+ `-i`/`--ignore-initial` with `SKIP1:SKIP2` and
+ `--bytes=N` as the long `-n`, using checked joined/separate count parsing
+ while retaining positional skips and `--`.
+7. **KIT-P2-012 — `cmp` operational status (accepted).** Return 0 for
+ identical inputs, 1 for differences, EOF, unreadable/missing files, or
+ comparison failure, and 2 only for usage. `-s` suppresses comparison output
+ but not operational diagnostics that explain a status-1 failure.
+8. **KIT-P2-009 — canonical version command (accepted).** Keep
+ `kit --version` canonical and implement a real internal `version` command so
+ `kit version` is byte-identical and `kit help version`, `kit version -h`,
+ and `--help` route correctly. Do not install `version` as a multicall alias,
+ and preserve `kit update --version VER`.
+
+### 12.7 Completed Phase 1 documentation/help work
+
+These findings remain in the baseline ledger for traceability but require no
+further remediation unless their existing regression checks fail:
+
+1. **KIT-P1-008 — build coordinator documentation (complete).** The shipped
+ protocol, variables/defaults, artifacts, and complete cache workflow are
+ self-contained and tested.
+2. **KIT-P1-009 — README/public API documentation (complete).** Lifecycle,
+ ownership, link flags, runtime headers, examples, and shipped-document links
+ pass the cold-distribution probes.
+3. **KIT-P1-010 — complete command help (complete).** All 41 pages have tested
+ examples and exit conventions; `targets` remains absent until implemented.
+4. **KIT-P2-004 — no-argument behavior documentation (complete).** Every
+ command states whether it shows help, reads stdin, enters a REPL, performs an
+ operation, or reports usage.
+5. **KIT-P2-005 — exit/help stream documentation (complete).** Every page
+ documents 0/1/2 and relevant exceptions; functional inconsistencies are
+ owned by their command-specific findings above.
+6. **KIT-P2-006 — ranlib equivalent spelling (complete).** Help uses the
+ accepted `ar rs ARCHIVE` workflow.
+7. **KIT-P2-010 — environment reference (complete).** Top-level and affected
+ command help document variable scope, defaults, state, and precedence.
+8. **KIT-P3-001 — truncated disassembly policy (complete).** Rendering
+ `(truncated)` is intentionally successful; fixed-width ISA regression cases
+ lock in that documented policy.
+9. **KIT-P3-002 — binary-tool help terminology (complete).** Accepted help
+ forms are listed and objcopy reports tool-specific errors.
+
+## 13. Baseline findings and evidence ledger
+
+The detailed entries below retain their Phase 1 severity, status, reproduction,
+and evidence wording. In particular, an entry saying `open` describes the
+immutable baseline disposition at audit time; section 12 records the current
+accepted resolution.
All IDs below are frozen baseline IDs. Reproduction records contain the exact
argv, cwd, stdout, stderr, status, and retained artifacts. For concise commands,
@@ -963,8 +1270,10 @@ expanded cwd, environment, and argv used for the recorded result.
### KIT-P2-007 — update default channel/setup is not discoverable
-- **Severity/blocking/status:** P2; not independently release blocking; live
- success BLOCKED, not a proven runtime defect; open. Phase 1 help now accurately
+- **Severity/blocking/status:** frozen baseline ID P2; the Phase 1 live-channel
+ result was BLOCKED and the discoverability finding remained open. Post-audit
+ source confirmation found an unsigned-index/test-anchor trust defect, so the
+ accepted section 12.2 remediation is a P0 release gate. Phase 1 help accurately
states that there is no built-in production index and documents curl-only
isolated setup, but cannot supply the missing release service configuration.
- **Affected:** `update` on clean installations.
@@ -980,6 +1289,12 @@ expanded cwd, environment, and argv used for the recorded result.
safe complete curl-based channel configuration/example.
- **Acceptance/regression:** clean isolated install can check/dry-run/update
without real-install mutation and without non-curl fetch helpers.
+- **Post-audit confirmation:** the updater parses an unauthenticated index even
+ though the release contract describes a signed channel. `driver/release_key.c`
+ embeds a non-release test public key whose matching secret material is in the
+ repository, and the official release scripts do not replace it. Section 12.2
+ defines the accepted production trust-anchor, signed-index, identity-match,
+ and downgrade-floor requirements.
### KIT-P2-008 — diagnostics do not suggest close valid values
@@ -1123,62 +1438,54 @@ expanded cwd, environment, and argv used for the recorded result.
- **Phase 1 result:** accepted help forms are listed and objcopy uses
tool-specific error terminology; candidate checks pass.
-### KIT-P3-003 — nm duplicate-symbol observation needs implementation confirmation
+### KIT-P3-003 — Mach-O linked symbol table contains duplicate canonical symbols
-- **Severity/blocking/status:** P3 observation; not release blocking; open for
- Phase 2 confirmation.
-- **Affected:** `nm` linked debug-image output.
+- **Severity/blocking/status:** P3; not release blocking; confirmed after Phase
+ 1 and accepted for implementation under section 12.5.
+- **Affected:** Mach-O linked symbol emission and linker symbol reports; `nm`
+ exposes the resulting file faithfully.
- **Personas/targets:** C and language developers inspecting symbols; observed
- native aarch64 Mach-O only, pending independent confirmation.
+ native aarch64 Mach-O, with x86-64 Mach-O in regression scope.
- **Reproduce/evidence:** run
`cd "$E/cold-toolchain/work/out" && "$K" nm debug-exe`;
cold-toolchain `workflow/nm` output contains `_add`
twice at the same address.
-- **Expected/actual:** one semantically useful row unless two distinct symbol
- table entries are intentionally exposed; baseline output duplicates the row.
-- **Impact/remediation:** possible confusing listing, but object semantics were
- not inspected in Phase 1. Confirm against independent symbol tables, then
- deduplicate or document.
-- **Acceptance/regression:** comparison with independent Mach-O symbol oracle;
- only add a functional test if confirmed.
-
-## 13. Prioritized remediation todo list
-
-The order below follows release risk and implementation dependency. Each change
-must remain tied to its finding ID and begin only after Phase 2 approval unless
-it is literal Phase 1 help/shipped documentation.
-
-1. **Distribution foundation:** fix KIT-P0-001 first, then rerun native,
- installed, relocated, Gram, API, platform, and freestanding driver cases.
-2. **Native hosted foundation:** fix KIT-P0-002 and validate sanitized native
- aa64/x64 SDK include/link/run before real-project/API reruns.
-3. **Safety/correctness:** red-green KIT-P0-003 and KIT-P0-004 before other
- compiler/linker polish; extend architecture mismatch coverage to all formats.
-4. **Target blockers:** implement KIT-P1-002, KIT-P1-003, and KIT-P1-004, then
- rerun the exact Android and all five freestanding cells with independent
- artifact oracles.
-5. **Required discovery:** implement KIT-P1-001 only in Phase 2, based on the
- complete 19-cell data model; then remove circular target references.
-6. **Incorrect success/damaging tools:** fix KIT-P1-005, KIT-P1-006,
- KIT-P1-007, and KIT-P1-012 with targeted exit/artifact tests.
-7. **Relocation/install:** fix KIT-P1-013 after support discovery semantics are
- stable; retest POSIX and Windows install representations.
-8. **Compatibility:** address KIT-P1-014 through KIT-P1-017, then KIT-P2-001,
- KIT-P2-002, KIT-P2-011, and KIT-P2-012; rerun Lua/cJSON/uthash and archive/
- freestanding journeys.
-9. **Phase 1 documentation/help (completed):** KIT-P1-008 through KIT-P1-010,
- KIT-P2-004 through KIT-P2-006, KIT-P2-010, KIT-P3-001, and KIT-P3-002 are
- fixed in the candidate. KIT-P1-011, KIT-P2-007, and KIT-P2-009 are truthfully
- clarified but remain open because their acceptance criteria require runtime
- behavior or external service configuration. Every baseline issue remains
- recorded above.
-10. **Diagnostic/polish:** KIT-P2-003, KIT-P2-008, KIT-P2-013, KIT-P3-001, and
- confirm KIT-P3-003.
-11. After narrow red-green cases, rerun affected architecture/ABI/format lanes,
- then the complete black-box release harness against a new candidate while
- retaining this immutable baseline.
-
-## 14. Exact harness rerun instructions
+- **Expected/actual:** one canonical external row unless distinct symbol-table
+ entries are semantically intentional; baseline output duplicates the row.
+- **Post-audit confirmation:** platform `nm` reports the same duplicate, and
+ `LC_SYMTAB` contains three external definitions: `_main`, `_add`, `_add`.
+ The linker mirrors a resolved undefined reference into a defined LinkSymbol;
+ ELF filters that noncanonical record, while Mach-O currently emits it.
+- **Impact/remediation:** the linked image itself contains redundant symbols.
+ Filter linked emissions through the shared canonical-global rule; do not
+ conceal the defect by deduplicating `nm` output.
+- **Acceptance/regression:** compare Kit and platform symbol oracles on
+ aarch64/x86-64 Mach-O; repeated reference/import records collapse, while
+ distinct aliases, locals, and versioned symbols sharing an address remain.
+
+## 14. Cross-workstream dependency and integration order
+
+Section 12 owns the complete finding list. This section records only the edges
+between workstreams so implementation can proceed in parallel without using
+severity as a scheduling proxy.
+
+| Foundation | Direct dependents | Integration gate |
+|---|---|---|
+| Canonical executable/distribution identity (KIT-P0-001) | Native SDK application (KIT-P0-002), installed alias repair contract (KIT-P1-013), all relocated driver/API journeys | Direct, PATH, alias, moved, spaces, isolated cwd, read-only distribution on POSIX and Windows |
+| Target-profile authority (KIT-P1-001) | Link input compatibility (KIT-P0-004), Android API define (KIT-P1-002), rv32 runtime selection (KIT-P1-003), RISC-V flags (KIT-P1-004), target suggestions (KIT-P2-008) | All 19 matrix cells represented; target resolved once and reported consistently |
+| Detached verification/trusted-key API (KIT-P1-011) | Signed production channel (KIT-P2-007), updater result semantics (KIT-P1-012) | Stock-Minisign interop, production anchor enforcement, authenticated index/package identity, downgrade rejection |
+| Backend normalization/public codegen options (KIT-P0-003) | Reserved `typeof` compatibility (KIT-P1-014), stack protection (KIT-P2-001), multi-source dependency orchestration (KIT-P1-015) | Portable-C O0/O1/O2, uthash, cJSON, and multi-source dependency lanes |
+| Binary input transactions and linked-image rewrite (KIT-P2-003, KIT-P1-007) | Relocatable/raw objcopy (KIT-P1-017), image rebasing (KIT-P2-002), canonical linked symbols (KIT-P3-003) | Runnable static/dynamic/PIE/shared artifacts plus independent format and symbol oracles |
+| Shared option/count parsing and suggestions (KIT-P1-016, KIT-P2-008) | Gram diagnostics (KIT-P2-013), CPIO/debugger failures (KIT-P1-005/006), checksum/cmp compatibility (KIT-P2-011/012), version routing (KIT-P2-009) | Direct/installed aliases, spaces/dashes/stdin, and uniform 0/1/2 behavior |
+
+Implementation within each row begins with narrow red-green tests at the
+lowest owning boundary. Once a row's direct tests pass, rerun only its affected
+architecture, ABI, format, project, or relocation lanes. After all rows pass,
+build a fresh distribution and run the complete black-box release harness. The
+immutable baseline must remain the comparison source; never replace it with
+`build/kit` or reconstruct a recorded command from prose.
+
+## 15. Exact harness rerun instructions
The reusable harness is under `test/audit/release/`; it requires exactly one
explicit product selection and never falls back to `build/kit` or PATH.
