M10 — Kernel-Hook Evidence Authority / Hybrid Observer Gate

Status

OPEN — ARCHITECTURE EVIDENCE GATE / NO PRODUCT INTEGRATION AUTHORIZED

Origin

Opened from the closeout of external technical criticism review #87.

Architecture review:
docs/architecture/PTRACE_VS_LSM_ARCHITECTURE_REVIEW.md

Review classification:
HYBRID_ARCHITECTURE_RECOMMENDED

Objective

Determine whether a hybrid Linux observer using BPF LSM security hooks + stable lifecycle tracepoints can provide stronger kernel-object-grounded evidence for selected ExecSurface propositions while preserving the current evidence semantics, metadata-only privacy boundary, explicit completeness/loss accounting, per-command containment, and backward-compatibility boundaries.

This is NOT authorization to replace ptrace.

Fixed roles

Innovative Systems Architect — seek stronger evidence authority than the current ptrace implementation.
Anti-Deviation / Skeptical Reviewer — prevent promotion of BPF/LSM merely because external criticism suggested it; require executable evidence.

Mandatory first gates

PATH-TOCTOU-001 — multithreaded pathname-buffer mutation; compare ptrace-copied entry argument with kernel-consumed object identity.
FD-SHARE-RACE-001 — CLONE_FILES shared fd close/reuse adversary; test successful-open identity attribution.
BPF-LSM-FILE-001 — audit-only file/open LSM hook proposition; no enforcement.
BPF-LSM-EXEC-001 — exec object/credential proposition correlated with lifecycle tracepoints.
BPF-LSM-CONNECT-001 — socket-connect mediation-point evidence vs current ptrace sockaddr observation.
LOSS-AUTHORITY-001 — force transport/event loss and prove fail-closed behavior.
PRIVILEGE-MATRIX-001 — hosted CI, containers, user namespaces, Yama/LSM/BPF capability matrix.

Authority rules

Until explicitly proved otherwise:

native ptrace remains public v0.1.0-alpha.3 correctness reference;
current Marketplace Action remains unchanged;
eBPF/BPF-LSM remains research-only;
no BPF-LSM PASS authority;
no BPF-LSM learn/check authority;
no backend auto-selection;
no ptrace/BPF-LSM baseline interchangeability;
no privileged daemon/service is authorized;
no runtime semantics change is authorized.

Promotion criteria

A proposition may be promoted only if the candidate backend demonstrates:

stronger or equal proposition semantics against adversarial counterexamples;
explicit session membership and lifecycle closure;
explicit producer/transport loss accounting;
fail-closed incompleteness;
metadata-only privacy parity;
stable versioned capability identity;
documented privilege/host requirements;
controlled differential evidence against ptrace;
no silent backward-compatibility break.

Product decision boundary

M10 may conclude that hybrid architecture is technically stronger but still unsuitable as a public default because of privilege, packaging, portability, or cost. Technical authority and product default selection are separate decisions.

M10.1 — PATH-TOCTOU-001 CLOSED

Classification: PTRACE_PATH_TOCTOU_COUNTEREXAMPLE_OBSERVED

Source SHA: 3503a757e5230b54c6d01d77c7ed4e7715563e61
Workflow run: https://github.com/AETHERXGLOBAL/execsurface/actions/runs/36420520715
Artifact: 10968584240
Artifact digest: sha256:6f22d3fb413f1f1238984dea3a616d3e9e64185afc217efff058f0d3a3cc20f4
Result commit: f3935cdecc1cdb1b84430b1932ce0838a89a8f81

Frozen result:

requested runs: 500
eligible complete warning-free runs: 500
PathAccessIntent vs kernel truth mismatches: 243
FileDescriptorAccess(Read) vs kernel truth mismatches: 0
incomplete/warning/observer/fixture errors: 0

Decision: universal kernel-authority for the ptrace entry-copied pathname is KILLED under concurrent shared-buffer mutation. PathAccessIntent must be interpreted as userspace argument metadata observed at ptrace syscall entry, not universally as the kernel-consumed object identity.

No public runtime/backend change is authorized by this result. main, v0.1.0-alpha.3, Marketplace behavior, baseline authority, and ptrace public authority remain unchanged.

Next mandatory gate: M10.2 — FD-SHARE-RACE-001.

M10.2 — FD-SHARE-RACE-001 CLOSED

Classification: PTRACE_FD_ATTRIBUTION_COUNTEREXAMPLE_OBSERVED

Source SHA: 6f6b3b35185dcbe111f4855901363f4dbe850769
Workflow run: https://github.com/AETHERXGLOBAL/execsurface/actions/runs/36421409534
Artifact: 10969715825
Artifact digest: sha256:38e538302613aa852575a861c387cac6576fa87ec6aec6ad88bf4ed32253a69c
Result commit: e1d763cede420d78236446a687933e57daddecee

Frozen result:

target exit: 0
observation complete: true
warnings: 0
target-proven successful A/B reads: 2851
emitted relevant fd-read events: 2018
count delta: -833
raw positional mismatch counter: 975 (diagnostic only after count divergence; not interpreted as 975 independent wrong-object events)

Decision: universal completeness of current fd read/write attribution under shared-fd close/reuse concurrency is KILLED. The decisive evidence is 833 target-proven successful relevant reads absent from the evidence surface while complete=true and warnings are empty.

No public runtime/backend change is authorized. main, v0.1.0-alpha.3, Marketplace behavior, baseline authority, and ptrace public authority remain unchanged.

Next mandatory gate: M10.3 — BPF-LSM-FILE-001 (audit-only research prototype; no enforcement).

M10 execution update — isolated development started

All new work remains isolated from main, v0.1.0-alpha.3, Marketplace behavior, public ptrace authority, and existing baselines.

Fixed roles retained

Innovative Systems Architect
Anti-Deviation / Skeptical Reviewer

Closed adversarial gates already present on `research/m10-hybrid-observer`

M10.1 PATH-TOCTOU-001: PTRACE_PATH_TOCTOU_COUNTEREXAMPLE_OBSERVED — 243/500 adversarial complete observations had entry-time pathname intent differ from independently established kernel-opened object truth.
M10.2 FD-SHARE-RACE-001: PTRACE_FD_ATTRIBUTION_COUNTEREXAMPLE_OBSERVED — target established 2851 successful relevant reads while current ptrace evidence emitted 2018 relevant read events, missing 833 despite complete == true and zero warnings.

M10.3 BPF-LSM-FILE-001

A deeper disposable branch was created:
research/m10-hybrid-observer-m103

Preregistered protocol:
docs/milestones/M10_3_BPF_LSM_FILE_PROTOCOL.md

Prototype now includes:

audit-only lsm/file_open BPF LSM hook;
explicit TGID -> session membership map;
ring-buffer drop accounting;
kernel-object (s_dev, i_ino) capture from struct file -> inode -> super_block;
controlled SIGSTOP registration barrier;
independent target fstat(2) ground truth;
frozen evaluator;
isolated CI evidence workflow.

The BPF program preserves prior LSM return value and introduces no enforcement.

Evidence so far

Hosted Ubuntu 24.04 runner exposes BTF but its active LSM list is:
lockdown,capability,landlock,yama,apparmor,ima,evm

Therefore BPF-LSM attach is currently classified:
M10_3_ENVIRONMENT_BLOCKED

This is deployment/portability evidence, not evidence against the object-identity proposition.

Accepted environment run:

workflow run 36422920886
artifact 10970237648
digest sha256:210080cfcce0c394de9a5432708ca6f1600a2c1569e454488b23a3caa9738858

A separate build-validation path was added so hosted attach capability is not conflated with prototype compile correctness. An initial build failure was preserved and attributed to missing Rust 1.82 rustfmt required by libbpf-cargo skeleton generation; the toolchain setup was corrected without changing the scientific proposition.

Current M10.3 state: OPEN — prototype/build validation in progress; hosted attach environment blocked; no authority promotion.

M10 isolated-development update (2026-09-28)

Public product remains frozen: no change to main, Marketplace behavior, v0.1.0-alpha.3, ptrace public authority, baseline comparability, or PASS semantics.

Research source-of-truth continuation: research/m10-hybrid-observer-m103.

M10.1 / M10.2

Already closed on the research lineage before this continuation:

PTRACE_PATH_TOCTOU_COUNTEREXAMPLE_OBSERVED
PTRACE_FD_ATTRIBUTION_COUNTEREXAMPLE_OBSERVED

No repeat was performed.

M10.3 — BPF-LSM-FILE-001

The isolated libbpf/Rust research implementation builds successfully, but GitHub-hosted Ubuntu 24.04 did not expose bpf in the active LSM list. The actual proposition step was therefore correctly skipped by the preregistered environment gate.

Recorded result:
docs/milestones/M10_3_BPF_LSM_FILE_RESULT.md

Classification:
M10_3_ENVIRONMENT_BLOCKED

This is portability evidence only; the object-identity proposition remains OPEN.

M10.3A — Hosted BPF-LSM capability matrix

Preregistered and executed across standard GitHub-hosted:

ubuntu-22.04
ubuntu-24.04
ubuntu-26.04

Workflow run: 36424752820

All three runners had readable kernel BTF but did not expose bpf as an active LSM. All reported unprivileged_bpf_disabled=2.

Classification:
M10_3A_ALL_STANDARD_HOSTS_BLOCKED

Result:
docs/milestones/M10_3A_HOSTED_BPF_LSM_MATRIX_RESULT.md

Engineering consequence: do not weaken M10.3 to tracepoints-only just to fit hosted CI. The next gate must provision a boot-controlled/custom or self-hosted Linux environment with BPF LSM explicitly active, then rerun the unchanged M10.3 proposition. No product integration is authorized.

M10 research branch progress — M10.3 closed for the tested GitHub-hosted runner.

Branch: research/m10-hybrid-observer
Protocol frozen before implementation: docs/milestones/M10_3_BPF_LSM_FILE_PROTOCOL.md
Audit-only prototype added under experiments/m10/bpf-lsm-file/; public core/main untouched.
Accepted workflow run: 36426361362
Artifact: 10971299575
Digest: sha256:3bb34d57837645ce2501b8a56eee3692b3dde98b41b209a484331b808dc5c1ff
Tested kernel: 6.17.0-1022-azure
BTF: available
Active LSM list: lockdown,capability,landlock,yama,apparmor,ima,evm
bpf absent from active LSM list.

Classification: BPF_LSM_FILE_HOST_UNAVAILABLE.

Interpretation: this is a host/deployment constraint, not a BPF-LSM semantic counterexample and not a PASS. It materially shows that BPF-LSM cannot be assumed to be a drop-in default for the current GitHub-hosted Marketplace path.

Result: docs/milestones/M10_3_BPF_LSM_FILE_RESULT.md

No change to main, v0.1.0-alpha.3, Marketplace behavior, ptrace authority, baseline compatibility, or BPF PASS/learn/check authority.

M10.3B — boot-controlled BPF-LSM environment gate started

Research remains isolated from main and the public alpha.

Branch: research/m10-hybrid-observer-m103b
Parent: research/m10-hybrid-observer-m103@ccc133f69b385e6062adb2db03285311e5d44e2b
Protocol: docs/milestones/M10_3B_BOOT_CONTROLLED_BPF_LSM_PROTOCOL.md

Fixed roles retained:

Innovative Systems Architect
Anti-Deviation / Skeptical Reviewer

Dynamic specialists for this gate: Linux kernel configuration, QEMU/boot, BPF privilege boundaries, CI/reproducibility, security-boundary review, internal red team.

Attempt 1

Run 36427677800, artifact 10972880684, digest sha256:76766eb67c254aab9bfe4f3a1384ae01fee1d0474999261ce0a75a815658b5ad.

Frozen evaluator emitted M10_3B_BOOT_BLOCKED, but review invalidated that as a harness artifact: the workflow selected the host Azure kernel and QEMU failed before boot on kernel-file permissions. Preserved in M10_3B_ATTEMPT1_HARNESS_REVIEW.md.

Attempt 2

Run 36428146126, artifact 10972132687, digest sha256:31dbde1025e881e204d7f66dea60c65259f0ff4f4236398a96ebc4c3b2bc74ab.

The repaired harness booted 6.8.0-142-generic successfully with lsm=bpf. Raw guest serial reached M10_3B_PROBE_COMPLETE and showed the active LSM value beginning lockdown,capability,bpf. The machine parser incorrectly concatenated the following BTF marker because /sys/kernel/security/lsm lacked a terminating newline; the frozen LSM_ACTIVATION_BLOCKED output is therefore not accepted. Preserved in M10_3B_ATTEMPT2_PARSER_REVIEW.md.

This raw evidence is already strong environment-feasibility evidence, but the gate is not closed from a malformed machine record.

Attempt 3

Marker framing was repaired without changing the scientific criteria, kernel prerequisites, QEMU/TCG model, lsm=bpf boot argument, classifications, or product authority rules.

Run 36428560620 is the clean rerun from SHA aa8fdca8cf8ad84556c84e18c034564a3a2651e6.

No public runtime semantics, Marketplace behavior, ptrace authority, baseline compatibility, or v0.1.0-alpha.3 files have been changed.

M10.3B closed / M10.3C executing

Fixed roles remain active:

Innovative Systems Architect
Anti-Deviation / Skeptical Reviewer

Dynamic specialists for the current gate: Linux LSM/BPF, VFS object semantics, libbpf/CO-RE, static initramfs engineering, QEMU boot, CI/reproducibility, and internal red team.

M10.3B — CLOSED

Accepted run: 36432629161
Accepted source SHA: 5ff4e4c57ad5dc5dd3f8c98ba40dff4e20dde8fc
Result: M10_3B_BOOT_CONTROLLED_CAPABLE

Accepted facts:

Ubuntu guest kernel 6.8.0-142-generic;
CONFIG_BPF=y, CONFIG_BPF_SYSCALL=y, CONFIG_BPF_LSM=y;
QEMU/TCG guest booted with lsm=bpf;
active guest LSM list: lockdown,capability,bpf;
guest BTF readable;
frozen machine probe completed;
workflow check concluded success.

Result document on research lineage:
docs/milestones/M10_3B_BOOT_CONTROLLED_BPF_LSM_RESULT.md

This grants environment capability only. It grants no semantic/public/product authority.

M10.3C — OPEN

Branch: research/m10-hybrid-observer-m103c
Protocol: docs/milestones/M10_3C_BOOT_CONTROLLED_FILE_AUTHORITY_PROTOCOL.md

The original M10.3 file-object proposition and frozen prototype were imported without semantic modification. The experiment is being built outside the guest only for packaging, then executed inside the BPF-LSM-enabled guest.

Two early runs were rejected as harness-only failures before scientific execution:

invalid package request for virtual bpftool;
Ubuntu linux-tools-common wrapper lacked the host-matched bpftool binary.

Neither result is interpreted as BPF-LSM evidence. The current harness installs the host-matched linux-tools-$(uname -r) while leaving the frozen BPF program/loader and M10.3 criteria unchanged.

Hard freeze remains: no main, Marketplace, v0.1.0-alpha.3, baseline, ptrace authority, PASS semantics, or product-integration change.

M10.3C — BPF-LSM-FILE-001 CLOSED / PASS

Fixed roles retained:

Innovative Systems Architect
Anti-Deviation / Skeptical Reviewer

Accepted run: 36436038157
Source SHA: c89351c9cef1ed19a2192ed9d7d82f814f07c94a
Artifact: 10975547912
Artifact ZIP digest: sha256:41262adfa3fea71cd82d011fb03c58239b5ac2a4ad632d7db3c881ea54aac6e4

Classification:
BPF_LSM_FILE_AUTHORITY_PASS

Accepted bounded facts inside the boot-controlled 6.8.0-142-generic guest with active lockdown,capability,bpf and readable BTF:

A independent truth (dev=2, ino=21) -> 100/100 accepted events;
B independent truth (dev=2, ino=22) -> 100/100 accepted events;
target exit 0;
other/unmatched object events 0;
wrong-session events 0;
ring-buffer reservation drops 0;
real lsm/file_open load/attach succeeded.

The earlier ABI-invalid semantic run is preserved and was not reclassified. Its repair was preregistered in M10_3C_PROTOCOL_AMENDMENT_001_FILE_OPEN_ABI.md before implementation.

Result document:
docs/milestones/M10_3C_BOOT_CONTROLLED_FILE_AUTHORITY_RESULT.md

Interpretation is proposition-bounded: BPF-LSM provided kernel-object-grounded file identity for this controlled gate. It does not grant public BPF PASS/learn/check authority, cross-backend baseline interchangeability, product integration, or a change to the public ptrace backend.

Stop rule for the file gate is now satisfied. Next mandatory gate: M10.4 — BPF-LSM-EXEC-001, preregister before implementation.

M10.3D — protocol-faithful file authority gate CLOSED

Classification: M10_3_OBJECT_IDENTITY_MATCH

Accepted execution:

branch: research/m10-hybrid-observer-m103d
source SHA: a2d20ce79b480681f806e25791954b37223db30d
workflow run: 36436257545 (success)
artifact: 10976285106
digest: sha256:24dc490dbc8cb572f17ef4d4c2a760b759065ac614dda4c89006297967326e96

Protocol-faithful evidence:

one registered target;
one controlled open after the registration barrier;
target-side fstat(2) truth: (dev=2, ino=21);
unique accepted BPF-LSM file_open event: (dev=2, ino=21);
events_total=1;
malformed=0;
wrong_session=0;
drops=0;
target exit 0.

The earlier M10.3C two-file/100-iteration path is preserved as non-interpretable for the original proposition because of fixture lineage drift and the discovered file_open hook ABI mismatch. It is not used as authority evidence.

Result: docs/milestones/M10_3D_PROTOCOL_FAITHFUL_FILE_AUTHORITY_RESULT.md

Interpretation: within this bounded fixture, kernel-object identity from the audit-only BPF-LSM hook matched the exact returned-fd ground truth and provides stronger object-grounded evidence for this proposition than ptrace entry-copied pathname metadata. This does not authorize public BPF PASS, learn/check, baseline interchangeability, backend auto-selection, ptrace replacement, or product integration.

Next authorized gate: M10.4 — EXEC, preregistering a hybrid design that must distinguish exec attempt from successful exec before implementation.

M10.4 — hybrid exec authority gate CLOSED

Classification: M10_4_HYBRID_EXEC_MATCH

Accepted execution:

branch: research/m10-hybrid-observer-m104
source SHA: a1c9e3b3158f666847a5692c21ad0f78b4357eb0
workflow run: 36438088623 (success)
artifact: 10976148266
digest: sha256:830a7c495c7b8ff851dcf000307cb86b6368ee09db86670f96f612bad83ae087

Evidence:

successful exec ground truth (dev=2, ino=14);
one BPF-LSM candidate with (dev=2, ino=14);
exactly one sched_process_exec success confirmation with (dev=2, ino=14);
failed exec returned ENOENT, with zero success confirmations;
malformed=0, wrong_session=0, unknown_role=0, drops=0.

Interpretation: within the bounded fixture, pre-commit exec mediation is kept separate from post-commit success confirmation, and successful executable identity is kernel-object-grounded. Failed exec was not promoted.

Result: docs/milestones/M10_4_EXEC_AUTHORITY_RESULT.md

No public BPF PASS, learn/check, baseline interchangeability, backend auto-selection, ptrace replacement, or product integration is authorized.

Next authorized gate: M10.5 — CONNECT authority.

M10.5 — CONNECT authority CLOSED / MATCH

Fixed roles retained:

Innovative Systems Architect
Anti-Deviation / Skeptical Reviewer

Accepted execution:

branch: research/m10-hybrid-observer-m105
workflow run: 36440309861
job: 108988768092
source SHA: d9641581c6ed97a16e23aa463f7da9a632cb66fd
artifact: 10977711272
artifact digest: sha256:f7f0183d431fa9468e7f48c45fda4863825c65b16984ea5802530fe152a30115

Classification: M10_5_HYBRID_CONNECT_MATCH

Bounded accepted facts:

BPF LSM socket_connect candidate matched the independently verified IPv4 loopback destination exactly;
sys_exit_connect independently confirmed the successful role with return 0;
child getpeername() and server-side accept() confirmed the same successful connection;
controlled failed role returned ECONNREFUSED / -111 and produced zero success confirmations;
malformed=0, wrong_session=0, unknown_role=0, drops=0.

Attempt 1 is preserved as a non-interpretable harness-only failure: tracefs was absent, preventing sys_exit_connect attachment before fixture execution. The accepted rerun changed only the guest tracefs mount, not BPF/loader proposition semantics.

Result: docs/milestones/M10_5_CONNECT_AUTHORITY_RESULT.md

No public/product authority changes. Next mandatory gate: M10.6 — LOSS-AUTHORITY-001.

M10.6 — LOSS-AUTHORITY-001 CLOSED

Classification: M10_6_REAL_LOSS_DETECTED_FAIL_CLOSED

Accepted execution:

branch: research/m10-hybrid-observer-m106
workflow run: 36441126663
job: 108991566916
source SHA: 92efa36c48ed83e2d004bf3505c6bac39cb483e1
artifact: 10979000328
digest: sha256:7d1b226e69edda854e7f2f7e3a4af4308b081134f7970cfedb9c6a43b2432e50

Frozen real-loss evidence:

requested / kernel attempts: 200000 / 200000;
accepted events: 127;
real bpf_ringbuf_reserve() failures: 199873;
exact accounting: 127 + 199873 = 200000;
malformed=0, wrong_session=0, target exit=0;
evidence_complete=false;
pass_authority=false.

No synthetic drop flag was used: the consumer was intentionally stalled while a 200,000-event registered burst filled a frozen 4096-byte ring buffer, and the BPF producer incremented drops only on actual reserve failure.

Result: docs/milestones/M10_6_LOSS_AUTHORITY_RESULT.md

No public/product authority change. Next mandatory gate: M10.7 — PRIVILEGE-MATRIX-001.

M10.7 — PRIVILEGE-MATRIX-001 CLOSED

Classification: M10_7_PRIVILEGE_MATRIX_CONFIRMED

Accepted execution:

branch: research/m10-hybrid-observer-m107
workflow run: 36442056048
job: 108994790907
source SHA: c992e81d1dada732a008ba25b34224fec71d5f19
artifact: 10978956771
digest: sha256:80cce53e0460a9f8152d49afb9e97b603705ba3574d79613ed5b271ba762fb32

Key facts:

standard GitHub-hosted Ubuntu 24.04: active LSMs lockdown,capability,landlock,yama,apparmor,ima,evm; no active bpf LSM; unprivileged_bpf_disabled=2; root generic BPF map-create succeeded;
default container: BPF map-create denied EPERM;
privileged container: generic BPF map-create succeeded, but host still lacks active BPF LSM;
boot-controlled guest: active lockdown,capability,bpf, BTF readable, root BPF map-create succeeded;
guest UID/GID 65534: BPF map-create denied EPERM;
new user namespace created, but BPF map-create remained denied EPERM in the tested guest.

Interpretation: stronger BPF-LSM evidence is technically deployable in managed/boot-controlled environments but is not a drop-in default for the current GitHub-hosted Marketplace path.

Result: docs/milestones/M10_7_PRIVILEGE_MATRIX_RESULT.md

All mandatory M10 gates are now closed. Next authorized action: M10 architecture closeout only; no product integration yet.

M10 FINAL CLOSEOUT

Final classification:
M10_BOUNDED_HYBRID_AUTHORITY_VALIDATED_PRODUCT_DEFAULT_DEFERRED

Closeout document:
docs/milestones/M10_HYBRID_OBSERVER_CLOSEOUT.md

Final conclusions:

M10.1 and M10.2 established real ptrace authority/completeness counterexamples;
M10.3D validated stronger bounded kernel-object FILE identity;
M10.4 validated hybrid EXEC attempt vs success semantics;
M10.5 validated hybrid CONNECT destination vs completion semantics;
M10.6 proved real producer loss can be accounted and fail closed;
M10.7 confirmed the privilege/deployment boundary: BPF-LSM is viable in compatible managed/boot-controlled environments but is not a drop-in default for current GitHub-hosted Marketplace users.

Product default replacement is therefore deferred. M10 authorizes only an isolated next-version integration/hardening program that makes evidence authority explicit, fixes the ptrace false-completeness gap, preserves current baselines, and treats kernel-hook evidence as an explicit capability until product gates pass.

main, v0.1.0-alpha.3, Marketplace behavior, existing baselines, and current public backend remain unchanged by M10.

Historical milestone disposition — M10 completed; subsequent work tracked separately

The final M10 closeout already recorded in this issue establishes the bounded result M10_BOUNDED_HYBRID_AUTHORITY_VALIDATED_PRODUCT_DEFAULT_DEFERRED after M10.1–M10.7, with explicit positive, negative and environment-limited findings. The original M10 evidence-discovery milestone has therefore reached its recorded conclusion.

What happened after this phase:

Portable ptrace fail-closed hardening and the acceptance of the clean release path were handled under M12 #90, with merged clean PR #92 and separately qualified release preparation.
The historical raw candidate PR #91 was closed unmerged / superseded, because its bulk M10 research content was not authorized as direct product code.
Ongoing proposition-scoped backend authority and external trace import remain separately tracked under #108 and #110, without promotion-by-assumption.
The current stable v1.0.0 product keeps native ptrace as the public reference observer. Managed BPF-LSM/hybrid does not become the default or a v1-correctness authority through this closure.

Decision: close this M10 research phase as completed/superseded by later explicit follow-up tracks. All M10 results, counterexamples, comments, exact branch/commit references and original limitations remain intact. This closes no continuing P4 research gate and makes no production-readiness or hybrid-deployment claim.

M10 — Kernel-Hook Evidence Authority / Hybrid Observer Gate #88

Description

Status

Origin

Objective

Fixed roles

Mandatory first gates

Authority rules

Promotion criteria

Product decision boundary

Activity

aetherxeg-source commented on Sep 28, 2026

M10.1 — PATH-TOCTOU-001 CLOSED

aetherxeg-source commented on Sep 28, 2026

M10.2 — FD-SHARE-RACE-001 CLOSED

aetherxeg-source commented on Sep 28, 2026

M10 execution update — isolated development started

Fixed roles retained

Closed adversarial gates already present on research/m10-hybrid-observer

M10.3 BPF-LSM-FILE-001

Evidence so far

aetherxeg-source commented on Sep 28, 2026

M10.1 / M10.2

M10.3 — BPF-LSM-FILE-001

M10.3A — Hosted BPF-LSM capability matrix

aetherxeg-source commented on Sep 28, 2026

aetherxeg-source commented on Sep 28, 2026

M10.3B — boot-controlled BPF-LSM environment gate started

Attempt 1

Attempt 2

Attempt 3

aetherxeg-source commented on Sep 28, 2026

M10.3B closed / M10.3C executing

M10.3B — CLOSED

M10.3C — OPEN

aetherxeg-source commented on Sep 28, 2026

M10.3C — BPF-LSM-FILE-001 CLOSED / PASS

aetherxeg-source commented on Sep 28, 2026

M10.3D — protocol-faithful file authority gate CLOSED

aetherxeg-source commented on Sep 28, 2026

M10.4 — hybrid exec authority gate CLOSED

aetherxeg-source commented on Sep 28, 2026

M10.5 — CONNECT authority CLOSED / MATCH

aetherxeg-source commented on Sep 28, 2026

M10.6 — LOSS-AUTHORITY-001 CLOSED

aetherxeg-source commented on Sep 28, 2026

M10.7 — PRIVILEGE-MATRIX-001 CLOSED

aetherxeg-source commented on Sep 28, 2026

M10 FINAL CLOSEOUT

aetherxeg-source commented on Oct 9, 2026

Historical milestone disposition — M10 completed; subsequent work tracked separately

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Closed adversarial gates already present on `research/m10-hybrid-observer`