kit

kit
git clone https://git.ryansepassi.com/git/kit.git
Log | Files | Refs | README

Kit 2026.6.0 black-box release audit

Phase 1 baseline report and accepted remediation record, 2026-07-15. This report covers the immutable release distribution preserved at build/audit/release-phase1/baseline/dist/kit. The baseline evidence remains unchanged; the post-audit decisions in section 12 approve the intended Phase 2 outcomes. That wording describes the frozen Phase 1 record; the live implementation checkpoint in section 12 records the completed remediation.

Throughout this report, evidence/... abbreviates build/audit/release-phase1/evidence/....

1. Executive release-readiness assessment

Release decision: NO-GO. The baseline is not ready to ship under the stated product contract. The audit records 37 findings: 4 P0, 17 P1, 13 P2, and 3 P3. All four P0s are release blockers:

  1. The compiler-driver family and executable linker do not resolve the shipped support tree relative to the distribution. Central workflows fail from an unrelated working directory and can accidentally consume repository ./rt files when run in the source tree.
  2. Native macOS cc hello.c does not automatically apply the valid SDK that cc -print-sysroot itself discovers.
  3. cc --emit=c -O1 terminates by signal instead of succeeding or returning a normal diagnostic.
  4. The linker silently accepts mixed x86-64/aarch64 Mach-O inputs and emits an arm64-labeled executable that traps at run time.

There is meaningful healthy depth behind those blockers. With explicit support/sysroot workarounds, native workflows, all six Linux cells, all seven FreeBSD/Windows/macOS cells, most freestanding cells, Lua, SQLite, the public API integration, Gram generation, CAS, packaging, JIT/interpreter execution, and most binary utilities pass. Direct kit ld plus the configured runners also executes correct freestanding programs on all five architectures. Those workaround results demonstrate backend capability; they do not satisfy the self-contained, relocatable release contract.

No target or advertised command was silently skipped. Android execution is explicitly NOT APPLICABLE because the configured support is compile/link-only. No matrix check was blocked by missing provisioning on this host. A successful live update-channel fetch remains BLOCKED because a production index URL and initial channel workflow are not discoverable from the distribution.

The Phase 1 help/documentation candidate does not change that decision or any functional baseline result. It fixes nine findings entirely within the allowed documentation surface and clarifies three more. Its help harness passes 168 of 172 cases; the only four failures are the deliberately unimplemented kit targets entry points reserved for Phase 2. All 41 installed command names produce routed, byte-identical help, and the candidate README, public API examples, runtime-header documentation, and complex-tool examples execute as documented. The four functional candidate failures are unchanged baseline defects, not candidate regressions.

The post-audit review accepted a concrete resolution for every remaining finding. Section 12 is the implementation authority: it groups all 37 findings by functionality and dependency rather than severity. At the Phase 1 close, nine documentation/help findings were already complete and 28 still required implementation. Their current status is the section 12 checkpoint. The review also confirmed that the updater accepted an unsigned channel index and that the repository's embedded test signing key was not a production trust anchor. That newly inspected trust-chain defect became a release gate attached to the frozen baseline ID KIT-P2-007; its remediation severity is P0 even though the historical ID is not renamed.

2. Product contract and audit boundaries

The audited product serves C developers using the command-line toolkit and language developers using shipped public headers plus lib/libkit.a. The acceptance standard is a self-contained, relocatable compiler/linker/tool suite that may use ordinary OS facilities and curl, but not a host compiler, assembler, linker, archive tool, binutils, or SDK-discovery helper. Native SDK, explicit hosted sysroot, freestanding, common GCC/Clang/binutils-style, and self-describing usage are in scope. Every command advertised by kit --help is treated as supported.

Phase 1 was black-box and had two discovery stages:

The initial audit did not inspect implementation source or internal tests to infer intended behavior. It made no functional implementation or existing-test changes and made no commits. The only allowed Phase 1 tracked surfaces are this report, the reusable black-box harness and fixtures, and later literal help/shipped-documentation remediation. Baseline results remain tied to the immutable copy even if a candidate help binary is subsequently built.

3. Exact baseline identity and environment

Item Recorded value Evidence
Audit time 2026-07-15T20:03:43Z / 2026-07-15T13:03:43-0700 evidence/meta/host.txt
Host macOS 26.3 (25D125), Darwin 25.3.0, arm64 evidence/meta/host.txt
Initial branch main...origin/main [ahead 1] evidence/meta/initial-git-status-branch.txt
Initial worktree clean evidence/meta/initial-git-status.txt
Original distribution /Users/ryan/code/kit/build/dist/kit evidence/meta/baseline-paths.txt
Preserved distribution /Users/ryan/code/kit/build/audit/release-phase1/baseline/dist/kit same
Exact binary preserved distribution bin/kit same
Binary version kit 2026.6.0 (6d73c1e, aarch64-macos) evidence/meta/kit-version.stdout
Repository/distribution VERSION both 2026.6.0 evidence/meta/version-files.txt
SHA-256 e16940b54338f4851a3932e9ea2e8af995935b81eb86f15c655234f146fde00a evidence/meta/{baseline,preserved}-kit.sha256
Binary type Mach-O 64-bit executable arm64 evidence/meta/baseline-kit.file
Dynamic dependencies only /usr/lib/libSystem.B.dylib evidence/meta/baseline-kit.dependencies

The full initial environment, including HOME, PATH, and TMPDIR, is in evidence/meta/environment.txt. Stateful workflows used isolated HOME, XDG, cache, config, data, temporary, installation, and output directories rather than the recorded user locations.

The shipped layout contains README.txt, VERSION, one bin/kit, 37 top-level public headers, five kit/support headers, lib/libkit.a, and the support/rt header/source tree. The complete inventory is evidence/meta/distribution-layout.txt.

4. Distribution, dependency, and relocation assessment

Check Result Evidence / qualification
Direct invocation from copied tree PASS with explicit support and SDK evidence/standalone/
Invocation solely through copied bin on PATH PASS with explicit paths evidence/standalone/
Distribution path containing spaces PASS with explicit paths evidence/standalone/, evidence/cold-distutils/33-relocation-results.txt
Sanitized HOME/XDG/TMP PASS evidence/standalone/, stateful distutility cases
Read-only input/source tree PASS evidence/standalone/
Host-development-tool sentinels PASS for corrected workflows; no sentinel hit evidence/standalone/, evidence/cold-distutils/
Native dynamic dependencies PASS: ordinary libSystem only evidence/meta/baseline-kit.dependencies
Explicit cross sysroots PASS for six Linux cells and depth runs on seven platform cells target evidence roots
Automatic shipped support discovery FAIL outside repository cwd evidence/standalone/default-relocated-isolated.* and target/platform evidence
Absence of repository-relative dependencies FAIL: defaults report/consume ./rt evidence/cold-api/search-dirs/, platform isolated-cwd evidence
Native SDK use without manual feedback FAIL evidence/targets-platforms/28-macos-auto-summary.txt
kit install --all aliases PASS before moving distribution evidence/cold-toolchain/workflow/install/, evidence/cold-distutils/32-relocate-setup-summary.txt
Move distribution after installation FAIL: absolute symlinks dangle, exit 127 evidence/standalone/installed-after-move.*
Update external helper PASS: failed live fetch invoked permitted curl only evidence/cold-distutils/update-fetch-corrected.log

The authoritative relocation result comes from an isolated cwd. A run from the repository root is invalid as standalone evidence because Kit reports ./rt and can consume source-tree material. Likewise, an early sentinel failure and an early move attempt described in the notes were audit setup errors; only the corrected records named above are counted.

5. Complete command and alias coverage matrix

All 41 advertised command names received no-argument, -h, --help, and kit help NAME probes. kit install --all created all 41 multicall names in an isolated prefix; every installed name executed its help, and representative aliases executed real workflows. “PASS*” means the implementation workflow passes but a material documentation/compatibility caveat remains. “FAIL” is a release-surface failure, even if an explicit workaround succeeds.

Command Result Minimal/nontrivial black-box coverage Installed name
cc FAIL preprocess, deps, check, object/asm/IR/C/LTO/debug, multi-source, link/run; support/SDK defects and C-output crash help PASS; compile reproduces support failure
check FAIL basic and macro/include checks pass with support; ordinary invocation fails support discovery help PASS
build-exe FAIL multi-source, O/debug/LTO, archive link/run pass with support help PASS
build-lib FAIL static archive and link/run pass with support; shared restriction tested help PASS
build-obj FAIL object, multi-source combine, asm, C, IR, stdout pass with support help PASS
build FAIL cold user blocked; recovered hidden syntax then first build/cache hit/rebuild pass help PASS
install FAIL default/all/verbose/dry-run/specific/space path pass; installed links fail after move help and installed products PASS before move
cpp PASS* file/stdout/output/stdin/include/define help PASS
as PASS* Kit-generated assembly reassembled; bad mnemonic diagnostic; stdin - gap help PASS
ld FAIL relocatable pass; executable/map/archive/run pass with support; default support failure help PASS
ar FAIL create/replace/list/print/extract/index/link; dashed -rcs rejected help PASS
cpio FAIL newc/gzip/LZ4 create/list/extract and symlink; corruption/conflict exit 0 help PASS
ranlib PASS* refresh, indexed archive link/run; documented ar s equivalent is false help PASS
strip FAIL object/archive/debug/keep-symbol pass; executable silently damaged help PASS
objcopy FAIL copy/add/remove/rename/validate pass; relocatable -O binary rejected help PASS
image FAIL flat/stdout/section/metadata/IHEX pass with bias; high-address/SREC limits hidden help PASS
objdump PASS headers/symbols/relocs/disassembly/content/DWARF/archive/private/dynamic help PASS (-h is an operation)
run PASS JIT/interpreter/multi-source/argv/stdin/program exit propagation help PASS
dbg FAIL scripted session and invalid command pass; missing script exits 0 help PASS
nm PASS* object/archive/sorted/global/prefixed executable help PASS
size PASS* Berkeley/SysV/hex/multiple/total help PASS
addr2line PASS* argv/stdin, function/pretty/basename source resolution help PASS
symbolize PASS* backtrace annotation and basename help PASS
strings FAIL file/stdin/multiple/min length/offset/prefix; common -- rejected help PASS
cas PASS* blob/tree add, inspect, verify, materialize, corrupted store rejection help and representative alias PASS
pkg PASS* keygen/create/inspect/verify/trust/TOFU/unpack/corruption; detached verify undiscoverable help and representative alias PASS
xxd PASS* table/plain/C array/stdin/reverse/round trip/space/dash path workflow alias PASS
cmp PASS* equal/different/quiet/verbose/skips/stdin; missing-file status and GNU gaps help PASS
hash PASS three algorithms/stdin/multiple/space/dash; SHA independent match workflow alias PASS
sha256sum PASS* fixed alias digest; no -c workflow alias PASS
b2sum PASS* documented BLAKE2b-256 alias; no verification mode installed/help PASS
crc32 PASS* fixed CRC-32 alias installed/help PASS
compress PASS* gzip/LZ4 file/stdin/auto-detect/corruption help PASS
gzip PASS* common flags, stdin/stdout, independent gzip -t workflow alias PASS
gunzip PASS* stdin/stdout round trip and empty-input failure workflow alias PASS
lz4 PASS* Kit round trip; independent lz4 oracle unavailable installed/help PASS
lz4c PASS* fast-mode Kit round trip installed/help PASS
disas PASS* x64/aa64/rv64 inline/file/stdin/base/mc round trip workflow alias PASS
mc PASS x64/aa64/rv64, stdin/plain/relocations/disas round trip workflow alias PASS
gram PASS* parse/dump/generate, generated C compile/link/run; grammar docs absent help PASS
update BLOCKED/FAIL isolated local package install/list/version and failed curl pass; live channel unavailable; --check status wrong isolated representative alias PASS

Detailed command evidence is indexed by evidence/cold-toolchain/all-cases.tsv and the summary files in evidence/cold-distutils/. The generated Gram executable produced tokens=2 rules=1 control=34 values=18 scratch=5; see evidence/gram-deeper/.

6. Help and documentation coverage matrix

For every command except the documented objdump -h operation, -h, --help, and kit help COMMAND are byte-identical on stdout with status 0. The top-level statement that no arguments equal --help is false for 21 commands. Formal examples exist on only 3 of 41 pages. The complete saved matrix is evidence/cold-help/help-matrix.tsv.

Legend: H0 = full help/status 0; U2 = usage/status 2; S0/S1 = empty-stdin success/failure; R0 = REPL then EOF/status 0; O1 = operational failure.

Command No args Example Exit convention Baseline help finding
cc H0 no missing says “see source”; incomplete flags/targets
check H0 no missing delegates to incomplete cc options
build-exe H0 no missing selected options only; no workflow
build-lib H0 no missing no static/shared workflow
build-obj H0 no missing no languages/emit workflow
build U2 no missing no definition/recipe grammar
install U2 no present no install/use/relocate workflow
cpp H0 no present circular target reference
as H0 no present circular target reference; no stdin example
ld H0 no present no complete/platform link workflow
ar H0 yes present later contradicted by ranlib help
cpio U2 no present no create/list/extract workflow
ranlib H0 no present claims rejected bare ar s equivalent
strip H0 no present help flags/examples absent
objcopy H0 no present defaults/restrictions absent; copied “strip” text
image H0 no present no freestanding example/address limits
objdump H0 yes present -h exception documented
run H0 yes present circular target reference
dbg R0 no present repository-test vocabulary; no script workflow
nm H0 no missing formats/archive/examples absent
size H0 no missing formats/archive/examples absent
addr2line H0 no missing address syntax/examples absent
symbolize H0 no missing PIE/load-bias and exits absent
strings S0 no present no examples/leading-dash convention
cas H0 no missing IDs/map/defaults/errors absent
pkg U2/full stdout no missing subcommand details/trust/examples absent
xxd S0 no present inline pipeline only
cmp U2 no present no examples
hash S0 no present no examples/check mode
sha256sum S0 no present generic hash title/usage
b2sum S0 no present generic hash title/usage
crc32 S0 no present generic hash title/usage
compress S0 no present no round-trip/interoperation example
gzip S0 no present generic compress title/usage
gunzip S1 no present generic compression-first usage
lz4 S0 no present generic compress title/usage
lz4c S0 no present generic compress title/usage
disas U2/full stdout no present circular target reference
mc U2/full stdout no present no target discovery/round trip
gram U2 no present grammar syntax/directives absent
update O1 no present default channel/setup absent

The shipped README's only documentation entry points, doc/DESIGN.md and doc/plan/, are absent. Public headers also refer to absent doc/BUILD_COORDINATOR.md, doc/CBACKEND.md, doc/DISTRIBUTE.md, and plan documents. No complete public-API composition example is shipped. The binary accepts unadvertised kit --version and kit version, while kit help version rejects the latter spelling.

The required absence of kit targets was reproduced before any remediation: it prints top help to stdout, kit: no such tool: targets to stderr, and exits 2. It must not be added to ordinary help until implemented in Phase 2.

Phase 1 help/documentation candidate

The candidate is separate from the immutable baseline at build/audit/release-phase1/candidate/dist/kit. Its binary is kit 2026.6.0 (6d73c1e-dirty, aarch64-macos), SHA-256 2e2114e8d61bf5e86ab5741e67c763c1a80ff76a8146c8b4267420d30b9d54b6, and depends only on /usr/lib/libSystem.B.dylib. The dirty marker records the uncommitted help-only source changes; this candidate is not a new baseline.

Candidate validation Result Evidence
Help entry points and required content 168 PASS, 4 expected FAIL (targets no-arg/short/long/routed) evidence/candidate-harness/help-final/summary.tsv
Installed aliases in a path containing spaces 41/41 exit 0, byte-identical routed stdout, empty stderr evidence/candidate-alias-help/summary.tsv
Functional/docs harness 8 PASS, 4 unchanged functional FAIL evidence/candidate-harness/functional-docs-final/summary.tsv
README C quickstart under sanitized state/tool sentinels PASS through compile/archive/index/link/run/inspect; no sentinel hits evidence/readme-candidate/
Help-derived build, Gram, CAS, and package workflows PASS evidence/candidate-examples/
Public and runtime header self-sufficiency 42/42 public and 27/27 runtime headers PASS functional/docs harness and evidence/candidate-runtime-headers/results.tsv
Dead-reference/source-direction scan of shipped user docs PASS evidence/candidate-doc-checks/forbidden-phrases-final.exit

Every page now contains an EXAMPLES section and an EXIT CODES section. Complex pages contain complete, tested workflows; alias-specific pages show the invoked name and defaults. Help documents observed restrictions and failures without presenting Phase 2 behavior as implemented. It does not advertise kit targets.

7. Successful workflow results

Workflow Baseline result Evidence / caveat
Preprocess and stdin preprocessing PASS cold-toolchain workflow/cpp, cc preprocessing
Dependency generation PASS single input; FAIL common multi-input -MM cold-toolchain and real-project Lua depend
Syntax checking PASS with explicit support workflow/check
Object and assembly output PASS with explicit support cc/build-obj evidence
Portable C output PASS O0; P0 FAIL O1 traps workflow/cc-explicit-support/portable-c
IR output PASS cc/build-obj evidence
Optimized output and LTO PASS cc/build-* evidence
Debug information PASS; independently consumed by Kit utilities objdump/nm/size/addr2line/symbolize evidence
Native system SDK FAIL default; PASS with support plus explicit -isysroot platform and standalone evidence
Explicit hosted sysroot PASS across Linux and platform depth cells target evidence roots
Freestanding compile/final link compile/direct ld/run PASS; driver baseline FAIL freestanding matrix
Multiple translation units PASS cc/build-exe/group evidence
Grouped/polyglot inputs PASS and run evidence/grouped-polyglot/
Weak/strong symbols PASS expected strong selection evidence/symbol-link-order/
Archive ordering PASS after-reference; expected undefined before-reference same
Startup objects/relocations PASS in freestanding direct-link matrix freestanding per-cell artifacts
Static libraries PASS ar/ranlib/build-lib/Lua
Shared libraries PASS on supported Linux/Windows/Android shapes target evidence; Android real fixture fails preprocessing
build-exe/lib/obj PASS with explicit support cold-toolchain workflow directories
Content-addressed build PASS after repository-only grammar recovery evidence/build-coordinator/; cold discoverability FAIL
Assembly/raw machine-code round trip PASS as/mc/disas evidence
Archive create/replace/list/extract/index/link PASS ar/ranlib evidence; dashed form caveat
Object inspection/transformation PASS for documented inputs objdump/nm/size/objcopy; binary restriction
Debug-data line/symbol flow PASS addr2line/symbolize workflow
Strip/validate PASS objects/archives; FAIL executable strip evidence
Flat image PASS binary/IHEX with appropriate bias; SREC/high-address gaps image evidence
JIT and interpreter execution PASS run workflow
Scripted debugger PASS valid script; FAIL missing script status dbg workflow/failure
CAS add/inspect/verify/materialize PASS including corruption rejection cold-distutils CAS summaries
Package create/signature/verify/unpack PASS native package and corruption/wrong-key cases; detached-sign verification undiscoverable cold-distutils pkg summaries
CPIO create/list/extract/compression PASS happy path; FAIL corruption/conflict status cold-toolchain cpio evidence
xxd/cmp/hash/compression aliases PASS round trips; documented compatibility findings cold-distutils summaries
Gram generate/compile/execute PASS with explicit support/SDK/include/libkit evidence/gram-deeper/; language syntax undiscoverable
Install/use multicall names PASS before moving extraction; FAIL after move standalone evidence
Update PASS isolated local signed install; failed curl returns 1; live success BLOCKED cold-distutils corrected update evidence

The most complete cross-tool journey compiled debug objects, archived/indexed them, linked and ran them, inspected symbols/sections/DWARF/disassembly, resolved source locations, transformed/stripped applicable objects, hashed and compressed artifacts, stored and materialized CAS content, packaged/verified/unpacked it, and compared retained bytes. Individual stages remain separated in the evidence so a downstream failure does not mask its producer.

8. Target matrix results

“Baseline” uses the immutable distribution without an undisclosed support override. “Depth” records explicit support/sysroot recovery and is not counted as release success. Every one of the 19 requested cells has an explicit result.

Selector Canonical triple Baseline Depth and execution
linux-glibc-aa64 aarch64-linux-gnu PASS dynamic exit 42; hello PASS; ELF independently validated
linux-glibc-x64 x86_64-linux-gnu PASS dynamic exit 42; hello PASS; ELF validated
linux-glibc-rv64 riscv64-linux-gnu PASS dynamic exit 42; hello PASS; ELF ABI validated
linux-musl-aa64 aarch64-linux-musl PASS static+dynamic exit 42 and hello PASS
linux-musl-x64 x86_64-linux-musl PASS static+dynamic exit 42 and hello PASS
linux-musl-rv64 riscv64-linux-musl PASS static+dynamic exit 42 and hello PASS
freebsd-aa64 aarch64-freebsd FAIL: support dir explicit support: static link, VM exit 42/hello PASS
freebsd-x64 x86_64-freebsd FAIL: support dir explicit support: static link, VM exit 42/hello PASS
freebsd-rv64 riscv64-freebsd FAIL: support dir explicit support: static link, VM exit 42/hello PASS
windows-aa64 aarch64-windows FAIL: support dir explicit support: PE console link, VM exit 42/hello PASS
windows-x64 x86_64-windows FAIL: support dir explicit support: PE console link, VM exit 42/hello PASS
android-aa64 aarch64-linux-android21 FAIL: NDK preprocessing minimal PIC/shared/-landroid PASS; NativeActivity FAIL; execution N/A
macos-aa64 aarch64-apple-darwin FAIL: support and SDK defaults explicit support/SDK: native exit 42/hello PASS
macos-x64 x86_64-apple-darwin FAIL: support and SDK defaults explicit support/SDK: Rosetta exit 42/hello PASS
freestanding-aa64 aarch64-none-elf FAIL: driver support dir direct ld and QEMU smoke/broad PASS; support workaround driver PASS
freestanding-x64 x86_64-none-elf FAIL: driver support dir direct ld and QEMU smoke/broad PASS; support workaround driver PASS
freestanding-rv64 riscv64-none-elf FAIL: driver support dir direct ld and QEMU smoke/broad PASS; support workaround driver PASS
freestanding-rv32 riscv32-none-elf FAIL: support/runtime/ABI flags direct ld/QEMU PASS with repo runtime; shipped driver runtime unavailable; output flags wrong
freestanding-arm32 arm-none-eabi FAIL: driver support dir direct ld and QEMU smoke/broad PASS; support workaround driver PASS

All requested sysroots and configured FreeBSD/Windows/Linux/macOS/QEMU runners were present. Android is intentionally compile/link-only in the configured matrix. Independent validation used /usr/bin/file and LLVM readelf where practical; Kit's own tools were also used, avoiding circular validation.

Evidence roots are evidence/targets-linux-android/, evidence/targets-platforms/, and evidence/targets-freestanding/. The exact selector/triple/sysroot/runner mapping came from repository-only provisioning infrastructure, itself evidence for the missing target-discovery finding.

9. Real-world project results

Clean copies were made below build/audit/release-phase1/work/real-projects/; the originals in tmp/projects/ were not modified.

Project Result Distinct coverage
Lua 5.4.7 PASS with explicit support/SDK generic Makefile, O2, installed ar rcu/ranlib, liblua.a, lua/luac; output Lua 5.4 42
SQLite 3.50.2 PASS with explicit support/SDK large amalgamation at O1, shell link/run; query 3.50.2|42
cJSON 1.7.18 ordinary Makefile FAIL; flag workaround PASS common probe chooses unsupported -fstack-protector; overriding R_CFLAGS builds archives/tests
uthash ordinary header FAIL; upstream workaround PASS advertised GNU identity selects unsupported __typeof; NO_DECLTYPE builds/runs
Lua depend FAIL common cc -MM l*.c rejected as multiple inputs

Commands, statuses, stdout/stderr, artifacts, and outputs are under evidence/real-projects/.

10. Language-developer API and distribution results

The Phase 1 candidate fixes the documentation failure without changing the API. The shipped README and headers now give a context/compiler/compile-session/ object/link/diagnostic/cleanup lifecycle and the exact distributed link form. The added source-session example, direct-CG example, diagnostic example, and all 42 public-header probes pass against the candidate distribution. All 27 runtime headers are also self-sufficient, and dead references in the shipped runtime README and header comments were replaced with self-contained guidance. See evidence/candidate-harness/functional-docs-final/, evidence/candidate-runtime-headers/, and evidence/baseline-runtime-docs/dead-references.log.

Fixtures are the api_context.c, api_compile_session.c, api_frontend.c, and api_diagnostic.c files under test/audit/release/fixtures/; evidence is evidence/language-api/ and the initial cold failures are under evidence/cold-api/.

11. Failure, diagnostic, and exit-code results

The requested convention is 0 success, 1 operational/tool-reported failure, and 2 bad command-line usage. Most parsers follow it and reject unsupported options specifically rather than silently ignoring them. Important exceptions are explicit below.

Failure class Result
Unknown tool status 2; direct dispatch also prints top help; no suggestion
Unknown flags generally 2 with specific rejection; no close-spelling suggestion
Unknown target/format/language 2 with value named; no discovery pointer/suggestion
Missing option argument/input generally 2; several no-arg tools instead help/0 or stdin/REPL
Conflicting flags cpio -o -t warns and returns 0
Missing/unwritable file generally 1; cmp missing file returns 2; ld can misreport missing entry
Wrong architecture mixed Mach-O link returns 0 and output traps
Wrong/malformed format generally 1 with recognized-object diagnostic
Duplicate symbol 1 with symbol named
Undefined symbol/archive order 1; traditional archive ordering observed
Malformed/truncated archive generally 1; cpio corruption returns 0
Corrupt compressed data 1
Corrupt CAS data verify/materialize 1
Corrupt/truncated package or wrong key 1
Bad detached signature verification workflow not discoverable
Failed curl fetch 1 in isolated update copy
Update check with no index diagnostic but status 0
Invalid debugger command 1; unreadable script returns 0
Invalid grammar 1 with location; bad CLI only generic usage/2
Unsupported optimized portable-C path diagnostic followed by signal, status 133

Specificity gaps include missing ld input becoming an entry-symbol error, strip missing.o saying only “not a recognized object,” and size printing a normal table header to stdout before total failure. Misspelled commands, flags, targets, languages, and formats do not suggest close valid values.

12. Accepted remediation ledger

This is the forward implementation contract. Severity remains part of each frozen finding ID for traceability, but it does not determine the order below. The workstreams are ordered by dependency, and findings appear under the component that should own the fix. Within a workstream, complete the numbered items in order unless a red-green test proves they are independent.

Status terms used here are:

Implementation checkpoint (updated 2026-07-16):

Finding Status Focused evidence
KIT-P0-001 Complete release standalone: 3 pass, 0 fail/blocked (direct/PATH/alias/spaces/read-only/default/invalid/cwd); Windows relocation VM: rc 0
KIT-P0-002 Complete test-driver-native-macos-sdk: 35 pass, 0 fail across aarch64/x86-64 compile and execution plus cc/check/cpp/build-*; precedence/ld/no-xcrun cases pass
KIT-P1-013 Complete POSIX move fails before repair and compiles/runs after install --force; Windows hardlink move/repair VM: rc 0
KIT-P1-011 Complete test-driver-pkg: 194 pass, 0 fail
KIT-P2-007 Complete test-selfdist: 107 pass, 0 fail; release/dist gates reject the test signer ID after copy, comment changes, or valid reserialization
KIT-P1-012 Complete authenticated updater result cases included in test-selfdist: 107 pass, 0 fail
KIT-P1-001 Complete target_test: 177 checks, 0 failures; test-driver-targets: 61 pass, 0 fail
KIT-P0-004 Complete public ELF/Mach-O/COFF matrix 114/0, including TAPI v2-v4 device/simulator/arm64e, import-library, pointer-width/endian boundaries; driver authority/inference/archive suite 15/0
KIT-P1-002 Complete NDK r27d NativeActivity preprocess/compile/shared-link at API 21 and 35; independent llvm-readelf confirms AArch64 ET_DYN plus exported ANativeActivity_onCreate: 3 pass, 0 fail
KIT-P1-003 Complete test-smoke-rv32: 20 pass, 0 fail, including concurrent empty-cache/read-only/QEMU cases
KIT-P1-004 Complete independent llvm-readelf rv32/rv64 soft/hard, mixed-ABI, and RVC merge oracle: 36 pass, 0 fail
KIT-P0-003 Complete test-driver-cc: 162 pass, 0 fail, including 12 portable-C native/cross O0/O1/O2 cases
KIT-P1-014 Complete reserved-typeof focused suite: 6 pass, 0 fail, including uthash probe
KIT-P2-001 Complete test-driver-stack-protector: 133 pass, 0 fail; cJSON build/test passes
KIT-P1-015 Complete 21 multi-source dependency assertions pass within test-driver-cc: 162 pass, 0 fail
KIT-P2-003 Complete test-driver-diagnostics: 33 pass, 0 fail; missing/unreadable/malformed matrix for ld/strip/size plus transactional output cases
KIT-P1-007 Complete object API 30/0, relocatable/archive 6/0, macOS linked 91/0, Linux PIE/shared/static 98/0, Windows x64/ARM64 original/debug/all runtime 54/0
KIT-P1-017 Complete relocatable ELF/Mach-O/COFF/Wasm-module and linked ELF/Mach-O/PE image cases, including loader-segment vs section spans and objcopy parity: test-driver-tools 284 pass, 0 fail; Wasm v1 has no distinct linked-image path
KIT-P2-002 Complete 32-bit boundary/overflow, negative bias, entry records, metadata, and transactional cases included in test-driver-tools: 251 pass, 0 fail
KIT-P3-003 Complete test-link-macho-symbols passes aarch64 and x86-64 Kit/platform oracles
KIT-P1-016 Complete conventional ar/as/linker spellings and direct/installed dash-path cases pass: ar 8/0, tools 253/0, strip 6/0
KIT-P2-008 Complete bounded command/target/frontend/format/option suggestion cases included in test-driver-tools: 253 pass, 0 fail
KIT-P2-013 Complete structured Gram CLI: 20 pass, 0 fail; full Gram suite: 70 pass, 0 fail
KIT-P1-005 Complete strict CPIO modes, corruption, trailer, pattern, decompression, and prevalidation cases: 50 pass, 0 fail
KIT-P1-006 Complete debugger explicit-script failure cases included in test-dbg: 38 pass, 0 fail, 1 unrelated expected failure
KIT-P2-011 Complete checksum manifest and checked cmp spelling cases included in test-driver-tools: 253 pass, 0 fail
KIT-P2-012 Complete cmp operational/usage status cases included in test-driver-tools: 253 pass, 0 fail
KIT-P2-009 Complete canonical version/help routing and non-installable alias cases pass in tools 253/0 and driver 162/0

Remediated candidate decision: acceptance gates pass. A fresh distribution built from source commit 084c82b2 with the explicit non-release test-signing configuration. Its .kpkg and detached .tar.gz.minisig both verify as signer c1709dd2922282f6, with package ID 37d5b7f4735e1a2bdfde489a2ff2009d261ca91be9da0883415c224dd564444b. The complete release harness selected 184 cases: 184 PASS, 0 FAIL, 0 BLOCKED, 0 NOT_APPLICABLE. The retained summary is build/audit-2026-6-0/final-candidate/harness/final-complete/summary.tsv. This closes the candidate gates without altering the immutable baseline NO-GO decision and evidence above.

12.1 Distribution identity, hosted discovery, and relocation

Dependency: establish one canonical distribution/executable identity first; SDK discovery and durable installed aliases must consume it rather than invent their own path rules.

  1. KIT-P0-001 — canonical support discovery (accepted; release gate). Explicit --support-dir wins and an invalid explicit value fails without fallback. Otherwise resolve the canonical running executable and probe <exe-dir>/support for a development build, then <exe-dir>/../support for a packaged distribution. Remove cwd and source- checkout fallbacks, and expose normalized absolute paths. Cover direct, PATH, installed alias, relocated, spaces, read-only, POSIX, and Windows invocations.
  2. KIT-P0-002 — native macOS SDK application (accepted; release gate). Native cc, check, cpp, and build-* compilation is hosted by default on both aarch64 and x86-64 macOS. Sysroot precedence is explicit --sysroot/-isysroot, then KIT_SYSROOT, then internal native SDK discovery. Resolve it once, apply that exact root to headers and linking, and make -print-sysroot report it. Do not borrow an SDK across operating systems or depend on xcrun; preserve freestanding opt-outs. Direct ld remains unhosted unless an explicit hosted request such as -lc requires SDK-backed startup/libc resolution.
  3. KIT-P1-013 — installed alias relocation contract (accepted). kit install aliases the existing binary; they are not promised to survive an arbitrary later move of that binary. After a move, kit install --force repairs them, while kit update owns the managed stable installation layout. Adjust the relocation harness so it tests failure before repair and success after repair, for POSIX symlinks and Windows hardlinks.

12.2 Package trust, release channel, and updater semantics

Dependency: expose one detached-signature verifier and trusted-key model, then use the same authenticated identity for the channel index and package before finalizing updater exit behavior.

  1. KIT-P1-011 — detached Minisign verification (accepted; release gate). Add kit pkg verify-signature [-p PUBKEY] [-x SIG] FILE, defaulting to FILE.minisig. With no -p, resolve the signature's key ID through the trusted-key store; do not use TOFU because a detached Minisign signature does not contain its public key. Add a public kit_pkg_verify_detached API returning signer ID and trusted comment. Interoperate in both directions with stock Minisign. Return 0 for valid, 1 for I/O, format, trust, or integrity failure, and 2 for usage. Keep detached verification distinct from package-container verification.
  2. KIT-P2-007 — authenticated production update channel (accepted; P0 release gate). Official release builds must provide a production index URL and production public key(s), must exclude the repository test key, and must fail the release build if either configuration is missing or a test anchor remains. Channel precedence is --index, environment, then the compiled stable URL; development builds may omit the default. Fetch with curl only, treat mirrors as untrusted transport, verify channel.index.minisig before parsing the index, and apply --key to both index and package verification. The authenticated package ID/version must match the selected entry, and the running binary version is the downgrade floor when no managed install exists. --check and --dry-run must not persistently mutate installation state.
  3. KIT-P1-012 — update result semantics (accepted; release gate). update --check returns 1 when no configuration exists or the index cannot be fetched, authenticated, or validated. Return 0 only after a valid index has been checked; an available update is still a successful check. Reserve 2 for usage errors and test clean isolated state, fetch failure, bad index, no update, and update available.

12.3 Target authority, input compatibility, and runtime ABI

Dependency: create the target-profile authority, resolve one effective target per operation, enforce it at the library link boundary, and use that same result for Android predefines, runtime selection, and RISC-V metadata.

  1. KIT-P1-001 — public target-profile registry and kit targets (accepted; release gate). Build the command from one public registry that covers all 19 audited cells plus compiled-in extras such as Wasm. Provide a human table, --format=triple, a versioned TSV form, and detail lookup by triple. Report architecture, OS, object format, hosted/libc/sysroot model, and capability separately from local provisioning. Move scripts/hosted.sh toward consuming this authority rather than duplicating it.
  2. KIT-P0-004 — link-session target compatibility (accepted; release gate). Enforce compatibility in the public/libkit link-session boundary, not only the driver. Validate raw objects, in-memory builders/LTO, every archive member, and DSO/import-library inputs for every output format. Compare architecture, format, pointer width/endian, ABI, and platform under explicit compatibility rules. An explicit -target is authoritative; otherwise infer from the first target-bearing input and require agreement. Diagnose named inputs with expected and actual properties before creating output, and fold the existing freestanding-only driver checks into this central path.
  3. KIT-P1-002 — owned Android API predefine (accepted; release gate). Give hosted dynamic predefines owned context storage so __ANDROID_API__ cannot borrow a stack slice. Define the exact API integer from the resolved target and cover NDK r27d NativeActivity preprocess, compile, and shared link for API 21 and a later API.
  4. KIT-P1-003 — on-demand rv32 Kit runtime (accepted; release gate). Build the needed runtime from shipped sources on demand rather than shipping a matrix of prebuilt variants. Resolve the final target, -march, and -mabi before runtime selection; separate soft- and hard-float cache keys. Populate an atomic user cache without writing the read-only distribution or invoking a host toolchain. Cover empty-cache/read-only relocation and QEMU execution with i64/floating-point helpers.
  5. KIT-P1-004 — RISC-V ABI flag merge (accepted; release gate). Merge ELF e_flags from all inputs in the central compatibility flow. Reject mixed float ABIs with named-input diagnostics, merge RVC/features according to the psABI, retain the result through relocatable and final links, and select the runtime from the same effective ABI. Verify rv32/rv64 soft/hard results with an independent readelf oracle.

12.4 C frontend, code generation, and compiler-driver compatibility

Dependency: normalize backend selection before optimizer construction, then extend frontend/codegen contracts, and finally broaden multi-source driver orchestration.

  1. KIT-P0-003 — portable-C optimization normalization (accepted; release gate). Accept --emit=c with -O0, -O1, or -O2 as the public contract already promises, but normalize the effective Kit optimization level to O0 before creating an optimizer. All spellings must emit usable C and must never signal; cover native and cross target selections.
  2. KIT-P1-014 — GNU-compatible reserved typeof spellings (accepted). Implement __typeof and __typeof__ for expression and type-name forms as unevaluated operands, preserving qualifiers, arrays, function types, and pointer types. Do not reserve plain typeof while the language mode remains C11 without an explicit GNU dialect. Retain compatibility predefines and add the uthash regression.
  3. KIT-P2-001 — real stack protector modes (accepted). Implement -fstack-protector, -fstack-protector-strong, -fstack-protector-all, and -fno-stack-protector in the shared native pipeline at O0 and optimized levels, with conventional function selection. Surface the mode through the public codegen option. Use target-ABI-correct guard access and failure symbols; freestanding output may leave the guard and failure hook unresolved but must never install a predictable fallback. Instrument every return and prevent tail exits from bypassing the check. Test symbol references, deliberate guard failure, native architectures, and cJSON.
  4. KIT-P1-015 — multi-source dependency generation (accepted). For -M/-MM, emit one rule per source in input order to stdout by default, or all rules transactionally to explicit -MF. For -MD/-MMD, generate the per-source dependency file during compile and compile-link flows. Preserve independent targets/paths, correct repeated -MT/-MQ behavior and escaping, and remove the single-source/-c restriction.

12.5 Linked-image and object transformation

Dependency: preserve primary input diagnostics, introduce a format-layer linked-image rewrite model, then build strip/objcopy/image behavior on it. Canonical linked-symbol emission is shared linker infrastructure and must not be hidden by presentation-layer deduplication.

  1. KIT-P2-003 — binary-tool input diagnostics and stdout transactions (accepted). Preserve the first primary file failure with its exact path and category; do not replace it with derived missing-entry errors. ld loads and validates inputs before opening output. strip identifies input or archive(member). size prints its header only after the first valid input; with no valid input stdout is empty. Multi-input tools may print valid rows while diagnosing invalid inputs, but return 1 if any input fails.
  2. KIT-P1-007 — strip linked executables and shared libraries (accepted; release gate). Add a libkit format-layer linked-image rewrite rather than parsing or relinking in the driver. Support applicable ELF, Mach-O, and PE architectures while preserving entry point, load layout/permissions, ABI flags, dynamic imports/exports/relocations, TLS, unwind data, and init/fini. --strip-debug removes only debug data; --strip-all also removes symbol tables not needed by the loader. Preserve executable mode and write transactionally for in-place and -o operation. Signed images fail unchanged by default; explicit --remove-signature removes signature metadata and requires later resigning. Test runnable static, dynamic, PIE, and shared outputs across formats.
  3. KIT-P1-017 — relocatable and linked raw-image conversion (accepted; release gate). For linked inputs, derive raw output from load segments; for relocatable inputs, use allocated sections with contents and reject unapplied relocations. Lay out by address, zero-fill gaps, and resolve overlaps deterministically in favor of the later selected section. Apply only/remove-section selection. Preserve section addresses in IHEX/SREC and do not invent a relocatable entry point. Route ELF, Mach-O, COFF, and Wasm through the image library and write transactionally.
  4. KIT-P2-002 — image rebasing and text-address semantics (accepted). --bias adjusts every emitted address, including entry; SREC termination and the IHEX start-linear-address record use the adjusted entry. Reject any remaining address above 32 bits before writing. Limit --base to flat formats; IHEX/SREC reject it with a --bias hint. Metadata records original and emitted base/entry. Cover boundary, overflow, negative-bias, and below/above-4-GiB cases.
  5. KIT-P3-003 — canonical linked symbol emission (accepted). The duplicate is confirmed in the Mach-O LC_SYMTAB by the platform nm; Kit nm is faithfully reporting a linker defect. Centralize the canonical-global predicate already used by ELF and apply it to Mach-O symbol emission and linker symbol reports. Recompute LC_SYMTAB, LC_DYSYMTAB, and indirect indices after filtering. Preserve distinct aliases, locals, and versioned symbols that legitimately share an address; do not deduplicate in nm. Cover aarch64/x86-64 cross-object reference/definition pairs, repeated imports, and same-address distinct aliases with Kit and platform oracles.

12.6 CLI parsing, diagnostics, and utility compatibility

Dependency: first share strict option/count parsing and bounded suggestion helpers; then implement command-specific semantics on top of uniform 0/1/2 exit classification and transactional output.

  1. KIT-P1-016 — conventional argument forms (accepted; release gate). Accept ar rcs and ar -rcs; accept raw assembler stdin as as - with <stdin> diagnostics; support -- in file-oriented tools. In the shared linker parser, make -Wl,-T,FILE,-e,SYM, joined/equal forms, --script/--entry, and equivalent -Xlinker sequences behave identically. Cover direct and installed aliases plus paths containing spaces/dashes.
  2. KIT-P2-008 — bounded valid-value suggestions (accepted). Add a shared, allocation-bounded, deterministic edit-distance helper that never autocorrects. Use a conservative threshold, stable tie-breaking, and a small result cap. Draw candidates from authoritative command, target, frontend, format, and option registries; when no target is close, point to kit targets. Preserve status 2 and stderr-only usage diagnostics.
  3. KIT-P2-013 — structured Gram usage errors (accepted). Return a structured parse error containing category, option, and offending value. Distinguish unknown option, missing option argument, invalid numeric value, and duplicate/missing grammar. Print the precise error before the synopsis, accept --, use the shared suggestion helper for unknown options, and complete parsing before file reads or writes.
  4. KIT-P1-005 — strict CPIO validation and modes (accepted; release gate). Conflicting modes return usage status 2. Corrupt/truncated archives, missing trailers, unsupported patterns, and failed explicit decompression return 1. Validate the full archive before extraction so failure cannot leave a partially trusted tree.
  5. KIT-P1-006 — debugger script failures (accepted; release gate). Missing, unreadable, overlong, or malformed explicit scripts return 1 in batch and interactive modes. Distinguish an explicit quit from an error and never convert a script failure into a successful REPL fallback.
  6. KIT-P2-011 — checksum verification and cmp option spellings (accepted). Add -c/--check manifests for sha256sum and Kit's BLAKE2b-256 b2sum, including stdin, standard hex/mode/filename syntax, exact digest-width validation, OK/FAILED, quiet, and status-only modes. Diagnose GNU BLAKE2b-512 manifests as incompatible rather than silently changing Kit's BLAKE2b-256 contract. Reject the manifest/payload dual-stdin conflict and reuse the generic hash path; crc32 remains digest-only. A checksum check returns 0 when every entry passes, 1 for mismatch, unreadable input, or malformed manifest, and 2 for usage. For cmp, add -i/--ignore-initial with SKIP1:SKIP2 and --bytes=N as the long -n, using checked joined/separate count parsing while retaining positional skips and --.
  7. KIT-P2-012 — cmp operational status (accepted). Return 0 for identical inputs, 1 for differences, EOF, unreadable/missing files, or comparison failure, and 2 only for usage. -s suppresses comparison output but not operational diagnostics that explain a status-1 failure.
  8. KIT-P2-009 — canonical version command (accepted). Keep kit --version canonical and implement a real internal version command so kit version is byte-identical and kit help version, kit version -h, and --help route correctly. Do not install version as a multicall alias, and preserve kit update --version VER.

12.7 Completed Phase 1 documentation/help work

These findings remain in the baseline ledger for traceability but require no further remediation unless their existing regression checks fail:

  1. KIT-P1-008 — build coordinator documentation (complete). The shipped protocol, variables/defaults, artifacts, and complete cache workflow are self-contained and tested.
  2. KIT-P1-009 — README/public API documentation (complete). Lifecycle, ownership, link flags, runtime headers, examples, and shipped-document links pass the cold-distribution probes.
  3. KIT-P1-010 — complete command help (complete). All 41 pages have tested examples and exit conventions; targets remains absent until implemented.
  4. KIT-P2-004 — no-argument behavior documentation (complete). Every command states whether it shows help, reads stdin, enters a REPL, performs an operation, or reports usage.
  5. KIT-P2-005 — exit/help stream documentation (complete). Every page documents 0/1/2 and relevant exceptions; functional inconsistencies are owned by their command-specific findings above.
  6. KIT-P2-006 — ranlib equivalent spelling (complete). Help uses the accepted ar rs ARCHIVE workflow.
  7. KIT-P2-010 — environment reference (complete). Top-level and affected command help document variable scope, defaults, state, and precedence.
  8. KIT-P3-001 — truncated disassembly policy (complete). Rendering (truncated) is intentionally successful; fixed-width ISA regression cases lock in that documented policy.
  9. KIT-P3-002 — binary-tool help terminology (complete). Accepted help forms are listed and objcopy reports tool-specific errors.

13. Baseline findings and evidence ledger

The detailed entries below retain their Phase 1 severity, status, reproduction, and evidence wording. In particular, an entry saying open describes the immutable baseline disposition at audit time; section 12 records the current accepted resolution.

All IDs below are frozen baseline IDs. Reproduction records contain the exact argv, cwd, stdout, stderr, status, and retained artifacts. For concise commands, let:

R=/Users/ryan/code/kit
D=$R/build/audit/release-phase1/baseline/dist/kit
K=$D/bin/kit
E=$R/build/audit/release-phase1/evidence
SDK_PRINTED=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk
SDK_MATRIX=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk

Each reproduction below is a shell command (or sequence) using these variables. The cited command.txt/.command file additionally preserves the fully expanded cwd, environment, and argv used for the recorded result.

KIT-P0-001 — shipped support tree is not resolved relative to Kit

KIT-P0-002 — native macOS does not automatically apply its discovered SDK

KIT-P0-003 — optimized portable-C emission terminates by signal

KIT-P0-004 — mixed-architecture Mach-O inputs silently create a crashing image

KIT-P1-001 — required target discovery command is absent

KIT-P1-002 — Android NativeActivity cannot preprocess NDK headers

KIT-P1-003 — shipped rv32 support cannot supply its compiler runtime

KIT-P1-004 — rv32 final ELF loses the single-float ABI flag

KIT-P1-005 — CPIO reports corruption and conflicting modes as success

KIT-P1-006 — debugger missing script exits success

KIT-P1-007 — strip silently damages linked executables

KIT-P1-008 — build coordinator cannot be authored from shipped material

KIT-P1-009 — shipped README/public API documentation is a dead end

KIT-P1-010 — CLI help is materially incomplete for supported workflows

KIT-P1-011 — detached pkg sign has no discoverable verification journey

KIT-P1-012 — update check reports missing configuration as success

KIT-P1-013 — installed multicall links do not survive distribution relocation

KIT-P1-014 — GNU identity selects unsupported __typeof

KIT-P1-015 — common multi-input dependency generation is rejected

KIT-P1-016 — common driver/binutils argument forms are rejected

KIT-P1-017 — advertised objcopy -O binary rejects relocatable objects

KIT-P2-001 — common stack-protector selection blocks cJSON

KIT-P2-002 — image text-format address limits/rebasing are hidden

KIT-P2-003 — diagnostics can lose the relevant input and pollute stdout

KIT-P2-004 — top-level no-argument promise is false for 21 commands

KIT-P2-005 — exit/help stream conventions are incomplete and inconsistent

KIT-P2-006 — ranlib documents a rejected equivalent command

KIT-P2-007 — update default channel/setup is not discoverable

KIT-P2-008 — diagnostics do not suggest close valid values

KIT-P2-009 — alias/version help identity is inconsistent

KIT-P2-010 — environment-variable discovery is fragmented

KIT-P2-011 — common checksum and cmp long forms are absent

KIT-P2-012 — cmp classifies a missing file as usage status 2

KIT-P2-013 — Gram CLI usage errors omit the offending argument

KIT-P3-001 — truncated fixed-width instruction disassembly returns success

KIT-P3-002 — small help terminology and accepted-help-flag omissions

KIT-P3-003 — Mach-O linked symbol table contains duplicate canonical symbols

14. Cross-workstream dependency and integration order

Section 12 owns the complete finding list. This section records only the edges between workstreams so implementation can proceed in parallel without using severity as a scheduling proxy.

Foundation Direct dependents Integration gate
Canonical executable/distribution identity (KIT-P0-001) Native SDK application (KIT-P0-002), installed alias repair contract (KIT-P1-013), all relocated driver/API journeys Direct, PATH, alias, moved, spaces, isolated cwd, read-only distribution on POSIX and Windows
Target-profile authority (KIT-P1-001) Link input compatibility (KIT-P0-004), Android API define (KIT-P1-002), rv32 runtime selection (KIT-P1-003), RISC-V flags (KIT-P1-004), target suggestions (KIT-P2-008) All 19 matrix cells represented; target resolved once and reported consistently
Detached verification/trusted-key API (KIT-P1-011) Signed production channel (KIT-P2-007), updater result semantics (KIT-P1-012) Stock-Minisign interop, production anchor enforcement, authenticated index/package identity, downgrade rejection
Backend normalization/public codegen options (KIT-P0-003) Reserved typeof compatibility (KIT-P1-014), stack protection (KIT-P2-001), multi-source dependency orchestration (KIT-P1-015) Portable-C O0/O1/O2, uthash, cJSON, and multi-source dependency lanes
Binary input transactions and linked-image rewrite (KIT-P2-003, KIT-P1-007) Relocatable/raw objcopy (KIT-P1-017), image rebasing (KIT-P2-002), canonical linked symbols (KIT-P3-003) Runnable static/dynamic/PIE/shared artifacts plus independent format and symbol oracles
Shared option/count parsing and suggestions (KIT-P1-016, KIT-P2-008) Gram diagnostics (KIT-P2-013), CPIO/debugger failures (KIT-P1-005/006), checksum/cmp compatibility (KIT-P2-011/012), version routing (KIT-P2-009) Direct/installed aliases, spaces/dashes/stdin, and uniform 0/1/2 behavior

Implementation within each row begins with narrow red-green tests at the lowest owning boundary. Once a row's direct tests pass, rerun only its affected architecture, ABI, format, project, or relocation lanes. After all rows pass, build a fresh distribution and run the complete black-box release harness. The immutable baseline must remain the comparison source; never replace it with build/kit or reconstruct a recorded command from prose.

15. Exact harness rerun instructions

The reusable harness is under test/audit/release/; it requires exactly one explicit product selection and never falls back to build/kit or PATH.

cd /Users/ryan/code/kit

# Full available suite against the immutable baseline distribution.
test/audit/release/run.sh \
  --dist build/audit/release-phase1/baseline/dist/kit \
  --out build/audit/release-acceptance \
  --run-id phase1-baseline

# A scoped help audit.
test/audit/release/run.sh \
  --dist build/audit/release-phase1/baseline/dist/kit \
  --module help --command 'cc,build-*,ld,cas,pkg,gram,update' \
  --severity 'p0,p1,p2'

# An exact candidate binary; distribution-only cases become explicit BLOCKED
# or NOT_APPLICABLE rather than searching the repository.
test/audit/release/run.sh --kit /absolute/path/to/candidate/kit

# Reproduce the final Phase 1 candidate help and functional/doc suites.
test/audit/release/run.sh \
  --dist build/audit/release-phase1/candidate/dist/kit \
  --module help \
  --out build/audit/release-phase1/evidence/candidate-harness \
  --run-id help-rerun
test/audit/release/run.sh \
  --dist build/audit/release-phase1/candidate/dist/kit \
  --module core,standalone,api \
  --out build/audit/release-phase1/evidence/candidate-harness \
  --run-id functional-docs-rerun

Every selected case records command, stdout, stderr, exit, metadata, assertions, state, reason, and retained artifacts in a unique run directory. summary.tsv is machine-readable and summary.txt is concise. Filters are available for module, command, workflow, target, architecture, format, and severity. PASS, FAIL, BLOCKED, and NOT_APPLICABLE are distinct; a filter that matches no cases is a harness usage error rather than a silent skip. Full instructions are in test/audit/release/README.md. The current reusable modules are help, core, standalone, and api; for example:

test/audit/release/run.sh --dist build/audit/release-phase1/baseline/dist/kit \
  --module core --workflow archive-link-run
test/audit/release/run.sh --dist build/audit/release-phase1/baseline/dist/kit \
  --module standalone
test/audit/release/run.sh --dist build/audit/release-phase1/baseline/dist/kit \
  --module api

For the already-completed broad matrix, do not reconstruct commands from prose: use the literal per-case .command/command.txt cwd/environment/argv records beneath the three target evidence roots with the capture wrapper identified by the corresponding target note, preserving the exact baseline $K. Provisioning recovery is make provision TARGET=<selector>; missing runner details are recorded in those notes. Never substitute build/kit.

All Phase 1 baseline evidence remains under build/audit/release-phase1/evidence/. The final help/documentation candidate results are under evidence/candidate-harness/, evidence/candidate-examples/, evidence/candidate-alias-help/, evidence/candidate-runtime-headers/, and evidence/readme-candidate/; none alters the baseline assessment above.