[Tim55667757]

Problem and behavior

First-ever WireGuard preparation could only build runtime through the legacy installation transaction, which cannot serve as a private source for an absent native generation. Add a consented private fresh preparer that runs the same source/configuration, executing-kernel, vendor-CVE and pinned toolchain/build gate into two separate transient snapshots. Retain a staged schema-1 baseline and derive a staged schema-2 candidate with the exact existing credentials/runtime/kernel facts.

Require retained three-file source pins and the approved current receiver callback pin. Refuse occupied, aliased, nested or managed-state paths. Write private files exclusively and receipts last; refuse interrupted prefixes on retry. Share the original payload construction without changing the direct-install wire format. No legacy installation transaction, managed root/unit, reservation/fence or network mutation is published.

Validation

• Native Windows: compileall, naming, Ruff, Linux-targeted mypy (80 source files), 152 focused tests passed; 136 POSIX-only cases explicitly skipped locally.
• Added 11 portable metadata/captured-descriptor refusal tests and 21 POSIX fresh-build, CVE-gate, drift, unsafe-path and interrupted-publication tests, including source-change/restore and descriptor numeric-alias regressions, all with intercepted native/network effects.
• Exact-head canonical Linux gate: passed, 3491 tests / 9 explicit skips, 90.20% coverage.
• Exact-head strict installed-wheel EN/RU/ZH documentation: passed, 99 documentation tests and 444 approved units per locale.
• Exact-head reproducible artifact and installed application: passed, 5 installed tests, reproducible wheel/sdist.
• Independent static review approved exact head 20b8f40968a1fc99477563b85e06d78c90c2b8ee after source/tests, EN/RU/ZH and provenance review; both captured-source binding findings are closed and all applicable exact-head gates passed.

Scope

Updates ADR 0024 and engineering documentation with approved source-bound RU/ZH catalogs. Private preparation grants no live attestation or transition authority. Fresh-build orchestration, authenticated common completion, epoch publication and public protocol admission remain integration work.

Continues #128; does not close the incomplete task. No live cloud, SSH, production server, WSL, desktop client or local network operations. No release.

[Tim55667757]

Independent AI review of exact head 20b8f40 completed under the owner's delegated review/merge authorization. Reviewed fresh source/receiver pins, vendor/kernel/toolchain gates, path exclusion, receipt-last/private-only writes, interrupted-prefix refusal, exact captured configuration validation, canonical descriptor numeric types, preserved legacy wire format and EN/RU/ZH provenance. Both P2 findings fixed; no remaining actionable findings. Exact-head Linux: 3491 passed / 9 skipped, 90.20% coverage. Installed-wheel docs: 99 passed. Reproducible artifact/installed application: 5 passed. No live infrastructure or local network operations. This COMMENT transparently records an AI review, not a human approval.

[Tim55667757]

Reviewed