WuciOS 2.4.0 · Source-only external review

Noether Forge

An Alpine-based, TTY-first realization of the WuciOS Noether Core profile. We publish the build source, pinned input lock, authenticated-fetch procedure, configuration, schemas, tests, and reviewer instructions. We do not distribute the ISO or upstream binary payloads.

Open review PR Read reviewer guide Status JSON

Source only No Noether Forge ISO, APK payload, package cache, or compiled release asset is published through this review lane.

Alpine substrate Authenticated Alpine Linux 3.24.1 x86_64 inputs.

Locked closure Exactly 52 signed APK payloads are fetched from pinned upstream locations.

Two firmware lanes The private review image passed SeaBIOS and OVMF/UEFI QEMU gates.

Public review packet

Inspect source and evidence boundaries.

Review is anchored to immutable commit 00171c4cbd377f7c3c200c8a2493ad42c90a1207. The pull request is the discussion surface; the commit is the measured subject.

01 / source

Buildable review material

Build logic, configuration, schemas, deterministic tests, and bounded reviewer instructions are public.

Does not include: generated build output or upstream binary payloads.

Browse reviewed source

02 / inputs

Authenticated Alpine acquisition

The explicit fetch step verifies the upstream ISO SHA-256, SHA-512, detached GPG signature, and locked APK closure.

Does not imply: Alpine project production, approval, certification, or endorsement.

Inspect input lock

03 / policy

Source-only publication guard

The publication policy excludes ISO images, APK payloads, package caches, compiled Wuci-Ji binaries, and generated kernel, initramfs, modloop, EFI, firmware, and bootloader binaries.

Does not grant: binary release or redistribution authority.

Inspect source-only policy

04 / reports

Bind review results

Reports should identify the reviewed commit, commands, host tools, and private-build digests when applicable.

Do not attach or redistribute a locally built ISO through an issue or advisory.

General review results

Measured at the review commit

A stronger build lane, with explicit limits.

At review commit 00171c4, the source-only guard, Noether Forge tests, and the WuciOS validator passed. The lane authenticated the pinned Alpine 3.24.1 input and exact 52-package closure, produced two byte-identical builds within one clean checkout and host toolchain, and booted the exact private image under QEMU using both SeaBIOS and OVMF/UEFI.

Build and boot verification after the fetch step consume the pinned local cache without network acquisition. That is a workflow property, not kernel-enforced network isolation. Cross-host reproducibility and reference physical-hardware validation have not been established.

The observed default-drop firewall and zero-listener posture is bounded runtime evidence. It is not a claim of general OS containment or runtime sandboxing.

Review status: review-requested · source-only candidate
Official release: false
Binary assets: not published
Repeat build: Byte-identical within one clean checkout and toolchain
Boot lanes: QEMU SeaBIOS and OVMF/UEFI
Physical hardware: not validated
External validation: false
Daylight role: Scoped repository provenance, not certification

Why there is no ISO download

Binary publication remains on hold.

This source-review record does not clear third-party binary redistribution or determine export classification. Binary publication also remains gated by reference-hardware evidence, production release signing, operated witness inclusion, and explicit publication authorization. This is a conservative publication hold, not a claim that every Alpine-derived image is unlawful.

License review incomplete

The repository Apache-2.0 license does not relicense Alpine or other upstream components. The generated SPDX inventory remains NOASSERTION; it is not license clearance.

Source and notice duties

Potential corresponding-source, notice, firmware, boot-component, and package-specific obligations require release-specific review before Wuci-Ji publishes assembled binaries.

Export treatment undetermined

This engineering publication policy is not legal advice and does not classify the image for export-control purposes.

Release authority absent

The release packet contains no production release signature, operated witness inclusion, accepted digest-bound reference-hardware evidence, or explicit binary-publication authorization.

Boot recording guidance

A sanitized video may supplement review.

For this project's review process, a recording may supplement a report only after it has been checked frame by frame, including audio, captions, thumbnail, and container metadata, and only if it contains no image file or download link. Remove keys, tokens, credentials, private paths, serial or asset identifiers, MAC or IP addresses, Wi-Fi identifiers, shell history, faces, room details, and location metadata.

The recording should identify itself as one private local run. It is not proof of an official release, cross-host reproducibility, physical-hardware validation, independent audit, certification, or endorsement, and it does not replace digest-bound machine-readable evidence.

Review from source

Build privately from a clean checkout.

The Noether Forge make targets are defined at immutable source-review commit 00171c4cbd377f7c3c200c8a2493ad42c90a1207. They are not available on main while PR #30 remains open. Check out that commit first, then use network access only for the explicit fetch step. Generated files remain under build/ and must not be published from this review lane.

Review checkout

git fetch origin agent/noether-forge-source-review
git switch --detach 00171c4cbd377f7c3c200c8a2493ad42c90a1207

Source-only guard

make wucios-noether-forge-source-guard

Deterministic tests

make wucios-noether-forge-test

WuciOS validation

make wucios-validate

Authenticated fetch

make wucios-noether-forge-fetch

Repeat build

make wucios-noether-forge-build

BIOS and UEFI verification

make wucios-noether-forge-verify

These are technical review instructions, not a grant of rights in third-party material. Reviewers remain responsible for applicable licenses and law, and this lane grants no permission to redistribute a locally built image.

Design history

Reduction Gate remains the ancestry, not the current release posture.

The earlier WuciOS v2.4 Reduction Gate separated Noether Core, Birkhoff Bastion, Tarski Review Appliance, and Euclid Substrate Trial. Noether Forge is the current Alpine realization selected for source-only external review; the earlier 96/100 substrate trial score is historical and is not a Noether Forge release score.

Read Reduction Gate history

Gödel Boundary

What Noether Forge does not claim.

Noether Forge is not an official or production WuciOS release, not a binary redistribution authorization, not externally certified, not independently audited, not government approved, not production cryptography, not quantum-safe by virtue of classical signatures and hashes, and not a general runtime sandbox or OS-containment claim.

Repository-owned Daylight evidence supplies scoped provenance and claim checking. It is not external certification, legal review, or publish/trust authority.