Adopt Jerboa 0.13.3 and qualify reproducible Conduit telemetry #8

Merged

ober merged 2 commits from feature/jerboa-0133-adoption-20260925 into main

2026-09-25 16:43:05 -04:00

ober commented

2026-09-25 15:50:16 -04:00

Owner

Summary

Adopt packaged Jerboa 0.13.3 and its supported deterministic-compilation namespaces, with distinct output/parent/child identities and stable source manifests.
Use the self-contained fresh runtime and bundled linker inputs. Remove the separate Chez/main.o requirement and upstream compiler rebuild. Keep consumer source/object paths separate from runtime extraction; clear compiler namespaces for metadata queries.
Resolve secure-key libc symbols through the trusted loader; use reproducible macOS linking without constant UUID rewriting.
Accept jsshd sequence-bound authenticated telemetry while retaining the existing framing path; reject wrong keys and tampering.
Add bounded same-event Conduit/private-to-legacy storage and real detector parity checks and evidence.
Advance VERSION and package manifest to 0.1.6.

Verification

Full make verify: security, generated Rust tests, Scheme checks and dependency audit.
Two complete release builds: all five binaries match byte-for-byte; typed lock/staticlib, release inputs and source manifest all match (status=match). Evidence directory: dist/reproducibility-jerboa-0133-isolated.
make binary-smoke: code-signature validation and all five binaries pass.
Post-build make security: hostile-loader regression and secret scan pass.
Telemetry tests reject wrong key and modified header, nonce sequence, ciphertext and tag.
Same-event fixture: two matching private/projected legacy rows produce one identical daemon alert; deliberately changing legacy severity fails.
Installed Jerboa remains usable after the builds. No separate compiler build tree was required.

This addresses downstream adoption of ober/jerboa#97.
See evidence/jerboa-0133-qualification-2026-09-25.md and
evidence/conduit-telemetry-parity-2026-09-25.md for scope and limits.
This is not production cutover or live legacy-receiver parity evidence.

## Summary - Adopt packaged Jerboa 0.13.3 and its supported deterministic-compilation namespaces, with distinct output/parent/child identities and stable source manifests. - Use the self-contained fresh runtime and bundled linker inputs. Remove the separate Chez/main.o requirement and upstream compiler rebuild. Keep consumer source/object paths separate from runtime extraction; clear compiler namespaces for metadata queries. - Resolve secure-key libc symbols through the trusted loader; use reproducible macOS linking without constant UUID rewriting. - Accept jsshd sequence-bound authenticated telemetry while retaining the existing framing path; reject wrong keys and tampering. - Add bounded same-event Conduit/private-to-legacy storage and real detector parity checks and evidence. - Advance VERSION and package manifest to 0.1.6. ## Verification - Full `make verify`: security, generated Rust tests, Scheme checks and dependency audit. - Two complete release builds: all five binaries match byte-for-byte; typed lock/staticlib, release inputs and source manifest all match (`status=match`). Evidence directory: `dist/reproducibility-jerboa-0133-isolated`. - `make binary-smoke`: code-signature validation and all five binaries pass. - Post-build `make security`: hostile-loader regression and secret scan pass. - Telemetry tests reject wrong key and modified header, nonce sequence, ciphertext and tag. - Same-event fixture: two matching private/projected legacy rows produce one identical daemon alert; deliberately changing legacy severity fails. - Installed Jerboa remains usable after the builds. No separate compiler build tree was required. This addresses downstream adoption of https://git.jerboa.sh/ober/jerboa/issues/97. See `evidence/jerboa-0133-qualification-2026-09-25.md` and `evidence/conduit-telemetry-parity-2026-09-25.md` for scope and limits. This is not production cutover or live legacy-receiver parity evidence.

ober added 1 commit

2026-09-25 15:50:16 -04:00