The docs name the programs, the compartment and the five kinds of test - #240

Comment stacks become one line, or a two-line block where the reason
needs it; long doc comments are cut to a line; test names lose their
sentences. Stale comments are corrected (SIT is not built, cgroup.rs
sets cpu and io limits too, Landlock's oldest ABI, misplaced docs).

Code changes: messages that read like essays are tightened, keeping every
substring a suite or test asserts on; explain() builds its rule lines
with one closure; cgroup.rs checks cgroup.procs in one helper, which its
test now exercises; the unused cap::SETPCAP, a no-op tuple binding and a
test that called no kryptikd code are removed.

main.rs, serve.rs, broker.rs, update.rs, time.rs, zone.rs and their tests
are left out: open pull requests change them.

Comment stacks in kryptik-wlproxy and zoneid become one line, or a
two-line block where the reason needs it, and long test names are cut to
a few words.

Code changes: the wlproxy session tests share two setup helpers, and
zoneid's error and audit messages lose their essays. The generated
protocol tables and zone-colours.h are unchanged.

launcher.sh, serve.sh and adversarial.sh lose their stacked comment
blocks, and the zone files and seccomp policies their multi-line notes.
Stale text is corrected: the ephemeral size comment contradicted zone.rs,
the vault note overclaimed, the K skip names zones-test.sh rather than a
developer VM that no longer exists, and F4c's message gives the 30 s it
waits. A dead assignment in E4a goes.

Every check ID, every line the CI workflow or zones-test.sh greps, and
every zone file key and value are unchanged. cli.sh and the probes are
left out: open pull requests change them.

The supply-chain tools (fetch, provenance, licences, source bundle), the
currency, support, kernel and hardening checks, the git hooks and their
suites lose their stacked comments; the data files keep one line per
column. Essay-like die and warn messages become a line or two, keeping
every substring a suite asserts on, and the help ranges still print
exactly each synopsis.

Code changes: verify-provenance.sh's messages no longer carry embedded
newlines and indentation into its report; check-support-status.sh counts
covered packages in its main loop instead of a second identical one; the
unused PASS_LIST, check-source-currency.sh's never-used work directory and
step-errexit.sh's unused yes_/no_ go; literal newlines inside tr arguments
are written as \n.

verify-signatures.sh, provenance-inventory.sh, key-provenance.tsv and the
verify-signatures suite are left out: an open pull request changes them.

The release tools (manifest, notes, channel, channel host, artifact
manifest), the image helpers, the net zone's programs, kryptik-efiboot,
kryptik-recover and their suites lose their stacked comments and essay
messages. Help ranges are fixed so each prints exactly its synopsis.

Code changes: kryptik-efiboot clears the immutable flag through one
make_mutable() helper instead of two copies; the release-manifest suite
checks the unenrolled-key refusal names the signers file; the s6-init
suite names its make target correctly; literal newlines in tr arguments
are written as \n. Output formats, wire strings and markers are unchanged.

acceptance.sh, most image suites, suite-lib.sh, vm-drive.py, tools/kryptik
and the installer are left out: open pull requests change them.

The stamp machinery in common.sh, the stages, every recipe, the service
scripts and s6 run files, the guest checks, the config lists and the
patch-set READMEs lose their stacked comments, history and rhetoric. Each
recipe drops its two-line "a stage 04 recipe, sourced by..." header.
Wrong comments are corrected: bc's shim name, shadow's man pages, the
boot-success re-arm file, testctl's key list, and the glibc README's claim
that the whole patch directory is fingerprinted.

Comments only. bash's declare -f output of every changed script is
unchanged and no heredoc body moves, so no recipe or stage function
re-fingerprints. Files hashed whole still move their step: the service
scripts, run files and sysctl file the late services step, the guest
checks the tests step, the allowlists stage 06's rootfs step, and the
kernel checker's accepted list its check step alone.

Meta-writing, history words, filler and long colon-and-semicolon chains
go from the hardening, threat-model and design docs and the compartments
README; chains become sentences or lists.

Corrected: stop --now kills zone pid 1, not the launcher, which survives
to close the volume; the seccomp filter refuses the set*id calls, capset
and inotify with an errno instead of killing; chown is in the base
allowlist, not net.seccomp; the kernel leaves SIT out, so the launcher's
sysctl matters only on kernels that build it in. Also: the artifact audit
is strict in acceptance too, and no release keeps a module key.

The stamp runner's refusals lose their history ("predates this harness")
and their essay, keeping every phrase step-errexit.sh matches; the
unchrooted escape hatch and stage 05's nested-tree check say what they
mean in a line. The console wrapper the console recipe writes gets one-
line comments, and firmware.list's header a tight format table. Stage
01's collapsed grep continuation is split again.

Fingerprints: the runner functions are excluded from every recipe's, and
stage 01's change leaves declare -f identical. The console recipe's
heredoc and firmware.list are step inputs, so the console step, the
linux-firmware step and every stage 04 step after them rebuild, with
stage 06; stage 05 builds on elfutils, earlier, so the kernel does not.

grep -c exits 1 when it counts nothing, and under the step's pipefail that aborted the recipe at the first such pattern, before its MISSING line and the summary that names them all.

…len against the buffer it was given (CVE-2026-77214) and fixes an integer overflow in expat_realloc on 32-bit targets (CVE-2026-102633), signed by the same subkey of the pinned key as 2.8.5

The image's python3 reads XML through the system expat
(--with-system-expat), so pyexpat carries the fix. x86_64 does not reach
the 32-bit overflow. 2.9.0 also drops the attribute-info and minimum-size
features, both off by default and never enabled by the recipe, and moves
the library to libexpat.so.1.13.0, still libexpat.so.1. The release
signature verifies against subkey CB8DE70A90CFBF6C3BF5CC5696262ACFFBD3AEC6
of the pinned 3176EF7DB2367F1FCA4F306B1F9B0E909AF37285.

…tries of 2026-09-30; data files only, nothing is built

…nted feature or interface; the binary the chroot runs and the source fallback move together, and the sum list that names both is signed by the pinned key

Upstream's note for 4.4.4 says only that implementation updates were made
for ecosystem changes and regressions. cmake builds json-c and nothing
else here and is not in the image. cmake-4.4.4-SHA-256.txt.asc verifies
against subkey C6C265324BBEBDC350B513D02D2CEF1034921684 of the pinned
CBA23971357C2E6590D9EFD3EC8FEF3A7BFB4EDA.

… line each

# Conflicts:
#	.github/actions/prepare/action.yml

… names

…comments to one line

# Conflicts:
#	compartments/tests/adversarial.sh
#	compartments/tests/launcher.sh

…ource, kernel and hardening checks

# Conflicts:
#	tools/git-hooks/pre-commit

…lease, image and on-system tools

# Conflicts:
#	tools/net/netzone-init.sh
#	tools/tests/s6-init-config.sh
#	tools/update/kryptik-recover

…ected against the code

# Conflicts:
#	docs/design/zone-policy-files.md
#	docs/hardening.md

# Conflicts:
#	build/recipes/tests.sh
#	build/services/getty-tty1/run

…and comments; report every missing firmware pattern

# Conflicts:
#	build/recipes/console.sh

…st names

# Conflicts:
#	compartments/kryptikd/src/consent/tests.rs
#	compartments/kryptikd/src/netzone.rs
#	compartments/kryptikd/src/registry.rs
#	compartments/kryptikd/src/seccomp.rs
#	compartments/kryptikd/src/seccomp/tests.rs
#	compartments/kryptikd/src/spawn.rs

…nlisted setuid bit or capability: it fails the build, and strips nothing

…unlisted setuid bit or capability, as it does

….max cap a zone, and io.weight needs blk-iocost or BFQ, which the kernel does not build

… kernel choice

…a row for a current pin

…tc 20260930 and cmake 4.4.4

…yptikd run, kryptik-launch, kryptik-wlproxy and kryptik-chrome, the sentence that a zone is the project's compartment, and the five kinds of test with one name each