Strict authentication Fly validation v1

Finite experimental tests on the approved strict-auth Linux artifact. This is safety and recovery evidence, not a public discovery progress guarantee.

Artifact and setup

The linux/amd64 binary is 932,328 bytes with SHA-256 5aa1f1bb74ce952d173eb9619618042db937c62a91b3039583a3b1328a0e1037. Registry image digest: sha256:e8dbe80412691c6406ba2ca3f32c1b8a2822d47a9d7f29d04c8052055c778589. Five Linux strict-policy regressions and an exact-image unprivileged admission/ replay smoke test passed before upload. No credentials are embedded in the image.

Each Fly run uses a temporary lax-region machine with one shared CPU, 256 MiB RAM, verified public TLS and explicit authentication: strict_v1. No client invitation is required. The native process runs as UID 10001. This is one receiver and controlled test clients, not independent operators or Internet-wide traffic.

Unchanged load test

The four cases use separate ledgers and 88 distinct fixture packets. Each case attempts 20 honest admissions, five queries, optional four streams of 100 forged requests, and a fresh recovery admission after pressure stops. The server lifetime is 45 seconds; request-work cases use the existing eight-bit challenge.

All four cases rejected every forgery, accepted the recovery admission, served the final query and reconciled committed claims with successful admissions, with zero late commits. The hostile target remains 16/20 admissions and 4/5 queries. Both hostile cases fail it. These single runs cannot isolate cryptographic cost from network scheduling or establish a comparison with historical timing samples. Strict signature validation does not solve contention for admission workers.

Reproduction and evidence

See docs/results/strict-fly-v1/: artifact.json, linux-tests.log, image-smoke.json, load-retry.json and rollover/summary.json. Initial registry authentication and digest-only launch failures are retained. A tag-plus-digest reference launched the same approved artifact; do not substitute an unpinned tag.

Run scripts/run_sustained_admission_fly.py and scripts/run_operator_rollover_fly.py with that tag-plus-digest image reference, the binary hash above, --authentication strict_v1 and fresh --output paths. Both runners verify the remote binary hash and preserve the existing machine configuration during cleanup. A failed progress target is not waived by their safety/accounting pass result.

Recovery and cleanup

The separate operator test retired eight old-epoch claims, rejected the stale claim and admitted a new-epoch claim. After process restart, replay restored one discovery result while the journal hash stayed identical. Both phases recorded one claim and zero late commits. This tests orderly restart, not power loss.

Both temporary Fly machines were destroyed. The historical machine remained stopped with unchanged configuration; no public service remains.

Next step

Keep the accepted best-effort service contract and the failed progress targets. Before another policy or scale change, extend the implementer-facing conformance package to cover strict-profile admission transitions and restored-state rejection. The strict adapter currently covers authentication operations only; legacy trace passes are not strict-profile conformance. Independent implementation and review remain open. No new cap sweep or semantic-tree optimization is justified here.