Constrain guest acceptance work to the original parent clock budget

scripts/acceptance/colima-window/README.md

@@ -1,11 +1,17 @@
 # One-shot default-Colima handoff proposal
 
-This source accompanies #210. It is not admitted for execution. It preserves the
-separately reviewed task controller at `df617fb681958801182e67ca63e886041bec6de0`
-and its 13-member manifest
-`9ce029dcfb64220ff233e9f42605400ea4a73aceb598272a4034b3e8a65d6e38`.
-The outer source is a separate review subject. It does not change the Linux
-process epochs, guest/network controls, fixed task store or acceptance rules.
+This source continues #191/#192 after #210. It is not admitted for execution.
+The exact successor task controller, runtime manifest and controller digest are
+bound by `SDK_R`, `SDK_M` and `SDK_CODE_SHA` in `window.py`. The outer controls
+load that selected Git blob, independently of the working checkout's task code.
+The successor constrains the guest work/cleanup/audit schedule to the unchanged
+parent ceilings using a resident guardian's paired clock observation.
+
+The original `df617fb` / `bdbb4d4` source and private invocation stay frozen and
+unexecuted. This successor requires its own source/input subject and private
+invocation; it inherits no blocked-review PASS or operating authority. Linux
+process epochs, guest/network controls, fixed task store and history acceptance
+rules remain unchanged.
 
 The selected existing Intel macOS/VZ host cannot currently meet the task's
 10-GiB available-memory gate while its default Colima profile runs. General owns

scripts/acceptance/colima-window/test_window.py

@@ -6,6 +6,7 @@
 import pathlib
 import plistlib
 import shutil
+import subprocess
 import sys
 import tempfile
 import time
@@ -16,7 +17,8 @@
 spec = importlib.util.spec_from_file_location('colima_window_controls', HERE / 'window.py')
 window = importlib.util.module_from_spec(spec)
 spec.loader.exec_module(window)
-CODE = (HERE.parent / 'condition-history/guest-host.py').read_text()
+CODE = subprocess.check_output(['git', '--no-replace-objects', '-C', str(HERE.parents[2]),
+    'show', window.SDK_R + ':scripts/acceptance/condition-history/guest-host.py'], text=True, timeout=20)
 SOURCE = window.sha((HERE / 'window.py').read_bytes())
 TOKEN = '0123456789abcdef'
 BOOT = '11111111-1111-1111-1111-111111111111'

scripts/acceptance/colima-window/window.py

@@ -20,9 +20,9 @@
 import time
 import types
 
-SDK_R = 'df617fb681958801182e67ca63e886041bec6de0'
-SDK_M = '9ce029dcfb64220ff233e9f42605400ea4a73aceb598272a4034b3e8a65d6e38'
-SDK_CODE_SHA = 'bf9dbd8166c71dd1b87bc5761640ce26d07e624d56b19d26e40e5ff02eeab9a1'
+SDK_R = '86f65e1ca1b01baaa68f8d7256a7699dfda5f828'
+SDK_M = '2b0cfb21bd1a051bf8222879a304dadb87e93a4873693eb6e6978671313ca715'
+SDK_CODE_SHA = '006f6e0e9f7379a4593b2a73f4e77ff271da24b308ce497e3ca0aa54b210e603'
 KEYS = {'schema', 'token', 'source_sha256', 'host_boot_id', 'uid', 'scope', 'owner_process',
         'started_unix', 'sdk_intent', 'tools', 'service', 'config_files', 'disks',
         'docker_host', 'engine', 'profile_home'}

scripts/acceptance/condition-history/README.md

@@ -6,6 +6,11 @@ It is source under review. It has not built its consumer or run a container.
 Server history review and Security executable review precede a separate General
 admission of the exact runner commit, command, fresh capacity and absolute deadline.
 
+The original `df617fb` / `bdbb4d4` private proposal remains frozen and unexecuted.
+This clock successor is a new source/input subject; its R/M and host guardian
+identity must be captured independently. Source integration does not select its
+lifecycle, guest launch, consumer build, publication or installed execution.
+
 The package is crates.io `durable-workflow =4.12.0`, archive SHA-256
 `620a8287af73c363dac61f0a91f20971a39f3b8cdc9513fbea85cdbd95a74ba4`,
 source `4b2440a5618ccc1c98960ea2e1e62127042c3590` (H). Its published tag,
@@ -88,21 +93,30 @@ daemon. Before work creation or registry requests, read-only preflight refuses
 any existing owner/run container, network or volume and every colliding exact name.
 An uncertain query is a refusal.
 
-One 30-minute absolute owner window includes setup, fetch, compilation, execution
-and cleanup. Active work ends 60 seconds before the final ceiling. The Cell's
-roles share one maximum 600-second deadline plus a 10-second TERM/KILL grace.
+The unchanged 30-minute parent window includes setup, fetch, compilation,
+execution and cleanup. The guest uses a fresh start G inside that parent lease,
+not a renewed 30-minute envelope. A resident-parent clock receipt maps the
+parent's original monotonic deadline conservatively into the guest clock.
+Guest active is `min(G+1740, mapped_parent_active-180)`; guest cleanup is active
+plus 60 seconds, leaving at least 120 seconds before parent active for the
+independent guest audit/export. Admission requires at least 600 active work
+seconds still available. Late setup refuses before store allocation, VM
+create/start and guest work allocation; it does not extend any parent cutoff.
+The Cell's roles share one maximum 600-second deadline plus a 10-second
+TERM/KILL grace.
 `run.json` is an exclusive owner-only regular single-link record binding R, H,
 manifest and recovery digests, token, local daemon, root, UID/GID, isolated owner
-PID/group/session, Linux boot ID and kernel start ticks, and all three deadlines.
+PID/group/session, Linux boot ID and kernel start ticks, the parent clock receipt,
+and all three deadlines plus the derived fixed guest monotonic cutoffs.
 Execution requires Linux proc authority. Identity observations must agree across
 two kernel-stat reads and boot reads; recovery revalidates that tuple immediately
 before each TERM or KILL. A missing or changed authority refuses the signal.
 Its digest is captured outside
 the work root in the private launch handoff.
 
 Before any pull, the owner starts a detached recovery process from captured
-inline bytes and requires its exact readiness receipt. At the active cutoff it
-uses its captured complete authority to stop the exact owner and remove only
+inline bytes and requires its exact readiness receipt. At the fixed guest
+monotonic active cutoff it uses its captured complete authority to stop the exact owner and remove only
 matching immutable container/network IDs. A later source/record drift fails the
 result but cannot replace the already-captured cleanup authority. Foreign process
 epochs, labels or names are refused. Interrupted Cell evidence is purged because
@@ -111,9 +125,15 @@ bounded by the final ceiling. No edit, retry, fallback or extension is included.
 
 After source review and a separate exact execution admission, use the reviewed
 inline collector below. `R`, `M`, `CHECKOUT`, fresh `W`, token `T`, local daemon
-`D`, and captured `S`/`ACTIVE`/`CLEANUP` belong in the private proposal. `ACTIVE`
-is `S + 1740` and `CLEANUP` is `S + 1800`. Do not substitute a mutable script path
-for the captured entry point.
+`D`, and captured `S`/`ACTIVE`/`CLEANUP` belong in the private proposal. The CLI's
+`S` is fresh guest G. `ACTIVE` and `CLEANUP` follow
+the constrained formula above; `CLOCK_JSON`/`CLOCK_SHA` are the resident guardian's
+exclusive `guest-clock.json` and its canonical SHA-256. They bind the host record,
+both boot IDs, original parent Unix/monotonic ceilings and a bounded paired
+host/guest clock observation. The response-side remaining parent duration and
+rounding toward an earlier deadline account for transport uncertainty. They do
+not assume equal host/guest clocks or reopen a lease after a wall-clock change.
+Do not substitute a mutable script path for the captured entry point.
 
 ```sh
 python3 -I -S -c '
@@ -131,6 +151,7 @@ raise SystemExit(subprocess.run([sys.executable, "-I", "-S", "-c", entry,
   --package-commit 4b2440a5618ccc1c98960ea2e1e62127042c3590 \
   --work-dir W --run-token T --docker-endpoint D \
   --guest-boot-id B \
+  --parent-clock-json CLOCK_JSON --parent-clock-sha256 CLOCK_SHA \
   --started-unix S --active-unix ACTIVE --cleanup-unix CLEANUP
 ```
 
@@ -148,6 +169,14 @@ For immediate recovery or the mandatory independent final audit, capture
 `--run-token`. Audit also requires the externally captured `--summary-sha256`.
 Standalone recovery does not depend on a mutable checkout entry point.
 
+Recovery records use schema `condition-run/v5`, binding the same parent clock
+and derived monotonic deadlines through recovery, summary, guest audit and the
+independent host audit. The resident host guardian retains its produced clock
+digest in memory, checks it before accepting finish, and carries it in the
+cleanup receipt checked by independent host audit. Recomputing export digests
+cannot replace that clock observation. Command timeouts and recovery wakeups use those fixed
+monotonic deadlines; changing UTC cannot grant more time.
+
 The owner writes `summary.json` with `O_EXCL|O_NOFOLLOW`, mode 0600, and returns
 its immutable SHA-256. It records package/source/lock/binary inputs, exact role
 readbacks and fresh typed replay/live results. The fetch transport is the public

scripts/acceptance/condition-history/engine.py

@@ -259,7 +259,8 @@ def execute(args):
     watchdog, recovery_process_sha = start_recovery(args, record)
     result = {'outcome': 'fail', 'checks_outcome': 'fail', 'record_sha256': subject.RECORD_SHA,
               'runner_commit': args.runner_commit, 'package_commit': H, 'manifest_sha256': subject.CURRENT.sha256,
-              'recovery_process_sha256': recovery_process_sha, 'storage': record['storage']}
+              'recovery_process_sha256': recovery_process_sha, 'storage': record['storage'],
+              'parent_clock': record['parent_clock']}
     try:
         registry = registry_identity()
         images = [RUST, SERVER, MYSQL, REDIS]