[Judge-M]

The last named on-ramp before the Rust port (VISION.md Phase 6 / the Cycle-57 audit's Batch D). Two disjoint, all-additive lanes; the only reference edit is isolation.py, which is not a core-serialized file. Full heartbeat oracle green 226 → 228 checks (heartbeat: alive. ✓, exit 0).

Why now

Phase 6 (the single Rust port) is gated on two things Batch D delivers: a machine-checkable statement of what a port must reproduce, and the one enforcement seam a port will fossilize being as strong as it claims.

VECTORS — the port contract, frozen

decima/vectors.py + protocol/reference_vectors.json + heartbeat/checks/510_reference_vectors.py

build() re-derives — deterministically, from the running heartbeat reference through its public API only (fixed all-zero master seed, fixed event script, no wall-clock, no os.urandom, no floats) — the full golden set:

• canonical byte encoding + domain-separated content/event ids (edge cases: key-order invariance, NFC collapse of precomposed é vs. e+combining-acute to one identity, arbitrary-precision ints, empty containers);
• blob ids;
• principal derivation — named pid = blake2b(name) and self-certifying keyed pid = blake2b(pubkey), each with its Ed25519 public key;
• deterministic Ed25519 (RFC 8032) signature vectors;
• a fixed ASSERT/RETRACT fold script (TYPE_DEF · versioned CONTENT · a capability grant · its downhill ATTENUATION · a typed EDGE · a RETRACT) reduced to one comparable state_root.

The committed JSON is the code's frozen output, not a hand-authored fixture. Check 510 is a two-way lock: (1) build() re-run in-process must equal the committed bytes, so any change to canonical encoding / id derivation / the signing scheme / the fold turns the reference oracle RED the moment it lands; (2) every property is re-verified from first principles (domain separation, NFC-equal ids, keys reproduce, keyed pids self-certify, each signature verifies and a one-byte tamper fails closed, the script re-folds to the golden state_root, a tampered replayed byte is caught on read). A Rust port is correct iff it reproduces this file byte-for-byte.

SPAWNAUDIT — the seam is a syscall floor, not just a name scan

heartbeat/decima/isolation.py + heartbeat/checks/512_spawnaudit.py

Closes the backlog's named weakness ("harden assert_no_raw_spawn beyond name-matching"):

• (A) static — the AST scan now also refuses the laundering surface a re-adder would use to keep a spawn primitive out of the tree: reflective access (getattr/setattr/vars/globals/locals), namespace tables (__globals__/__builtins__/__dict__), and sys.modules[X] for any index but the sanctioned sys.modules[__name__] self-pass. The check shows the counterfactual: three laundered modules that pass the reconstructed original four-rule scan (no literal spawn token) are all refused, while executor/cli_worker and the self-pass idiom still pass (no false positive).
• (B) runtime — because no source scan can catch a spawn assembled at runtime, spawn_firewall() moves enforcement to the interpreter's audit boundary (PEP 578 sys.addaudithook): inside an armed region a spawn-family syscall raises IsolationError however it was spelled — proven with a laundered getattr(os, "sys"+"tem")("true") (no .system in its AST) blocked before the child exists, plus subprocess.Popen/os.posix_spawn. The sanctioned door (spawn_worker, now wrapping its own Popen in sanctioned_spawn()) still opens under the same active firewall, and the firewall is scoped (inert outside its region; hook installed lazily on first use) so it cannot break the interpreter's legitimate raw spawners (process_effect's gated CLI effect, the MCP stdio transport) or the wider test runner.

Testing

• cd heartbeat && python3 smoke.py → heartbeat: alive. ✓, exit 0, 228 checks.
• Run under an unprivileged uid: check 394_isolation's RLIMIT_NPROC fork sub-assertion only bites for a non-root user (root bypasses the limit) — an environment property, unchanged by and orthogonal to this batch. Under an unprivileged user the full oracle is green, as the release harness runs it.
• Regenerate the golden file after a deliberate, reviewed protocol change only: cd heartbeat && python3 -m decima.vectors (never hand-edit the JSON).

Follow-up

Batch D — the last named on-ramp — is done. P6 (the single Rust port) is unblocked; its first move is a Rust kernel that reproduces protocol/reference_vectors.json byte-for-byte, validated against check 510's contract.

🤖 Generated with Claude Code

https://claude.ai/code/session_012ath9hAwj37EriRGEDrj9a

---

Generated by Claude Code