[Brian Krabach (bkrabach)]

Problem

The published /setup page gives Ubuntu/Debian users only a generic instruction to copy a CA into the system directory. It does not emit the mistaken ~/usr path, but lacks a complete quoted command, administrator boundary, duplicate-download handling and separation of OS trust from browser trust.

Proposed correction

• Add a Linux section while preserving Android detection and macOS/Windows instructions.
• Quote normal and (1) download filenames; require independent host/CA fingerprint verification before installation.
• Use the absolute system directory, explicit modes and a stable .crt destination. Refuse existing destinations and multi-object PEM files; provide verification and conditional backout.
• Diagnose the browser's exact error, SAN/hostname, dates and disabled-warning state before another import. No TLS bypass, guessed NSS commands, automatic restart or trust-store action.
• Keep the deployment guide and rendered command blocks identical. Add focused tests and one path-scoped disposable-container CI check, not a new release prerequisite.

No CA rotation, authentication-policy change, TLS implementation change, frontend bundle change or live configuration change.

Qualification

Final candidate: 845983ae53c0dc231ac5ceaa0914f1477d42f6d7.

Check	Result
Managed focused tests	42 passed, 0 failed/errors/skips, including seven primary/cleanup harness controls, setup rendering, TLS and anonymous /setup auth coverage.
Rendered commands	Actual Chromium 153.0.8010.12, widths 320 and 1280. All six selected DOM command strings match source and guide; no horizontal document overflow.
Installed package	Wheel built and installed into a fresh guest venv outside the checkout with PYTHONPATH removed. Packaged renderer hash and generated HTML equal source. Installed/source screenshots are byte-identical per width.
Real system trust	CI run 40357278137: one disposable Debian 13.7 container. Exact rendered commands installed the duplicate-named synthetic CA, verified its leaf chain, rejected wrong CA/hostname and bundled input, refused overwrite, and removed trust.
Failure and cleanup	Injected failure retained exit 1, failed status and original RuntimeError; cleanup separately passed. Both invocations restored the baseline bundle hash, removed the destination and emptied temporary files. Exact container stop/removal and successful empty inventory were recorded.

The managed run used f20190c62; the final successor adds only the CI workflow and adapter. All nine recorded managed inputs and renderer/harness bytes are unchanged. This reuses exact affected-behavior proof, not a claim that a newly rebuilt whole wheel is byte-identical.

CI evidence artifact includes normal/injected JSON, command receipts, source/image/package identities, independent store observations and removal proof. Both the managed and CI guests were removed; they ran sequentially.

Independent source/evidence review found no blocking gap and recommends review/integration. Whitespace checks pass. Earlier unrun reports and review findings remain in the comments/history rather than being erased.

Limits and recommendation

• The real trust store tested was Debian 13.7, not an Ubuntu desktop. Ubuntu 24.04 was the controlling CI runner. Shared tooling supports this instruction correction; Ubuntu-version-specific browser trust is not claimed.
• Chromium tests cover rendering and selection, not browser certificate trust. Actual user Edge trust, Firefox/Snap behavior and enterprise policy remain separate.
• Real sudo ran as guest root; interactive authentication was not tested. The image is digest-pinned; APT versions are recorded, not transitively pinned.
• No real user's certificate store was changed. The existing client error and imported-root identity remain an open diagnosis; this PR does not justify another import or CA regeneration.

Recommendation: release-owner review and integration of this scoped instruction fix. This PR is left draft for that owner; no merge or publication has been performed.

[Brian Krabach (bkrabach)]

Frozen harness correction — still draft and unqualified

Successor: f20190c62ce779bfad0c9b5ef5e80c096db80308.

Independent review identified a reporting defect in the previous acceptance harness: cleanup errors could replace the injected primary error, and temporary-directory cleanup could fail after a passed report had been selected.

This successor changes only scripts/check_setup_ca_linux.py and adds tests/test_setup_ca_linux_harness.py:

• primaryFailure and ordered cleanupFailures are separate. The primary exception remains the terminal error when both fail.
• Removal, bundle rebuilding, temporary-directory cleanup and destination observation have separate recorded outcomes. Later cleanup still runs after an earlier cleanup failure.
• Success is selected only after required finalization succeeds. Changed-file and symlink refusal remain intact.
• Seven authored synthetic cases cover primary plus cleanup error/timeout, cleanup-only failure, successful finalization, and changed-file/ordinary-symlink/dangling-symlink refusal. These tests prohibit subprocess execution and use temporary files; they do not invoke the system-trust entry point.

Verification: source review found no remaining issue in this correction; whitespace checks passed. The seven controls and real guest/browser/build checks are not run. No runtime acceptance is claimed. The displayed /setup implementation, deployment guide and prior focused tests are byte-identical to the previous head.

Next qualification: add tests/test_setup_ca_linux_harness.py to the finite isolated check packet, then run the original exact-command/system-store, injected-failure, rendered-selection and package checks in the supported owned environment. Do not run the system-store script on a host or weaken the managed profile. Real client-browser trust diagnosis remains open; this correction does not justify a repeated CA import or certificate regeneration.

[Brian Krabach (bkrabach)]

Readiness independent qualification handoff — exact 845983a

The scoped Linux /setup increment now has execution evidence, not just placement or a draft. I recommend ordinary Releases review/integration of exact 845983ae53c0dc231ac5ceaa0914f1477d42f6d7 / tree 3914f7380aaf76e1be2938f4871f677877a4d57e. This is not a formal approving review, merge permission, or live adoption.

Independently checked

• Managed raw JUnit: 42 passed, zero failures/errors/skips, including all seven primary/cleanup/changed-file/symlink controls, actual Linux Chromium selection at 320/1280, setup/TLS and anonymous bootstrap/auth checks. The managed source was f20190c62 / tree 35f1ebfb; final successor adds only the CI workflow and adapter. All nine retained affected input hashes match the final Git candidate.
• Actual retained wheel SHA-256 b721b274b6c8e42561cb481c8bb288859fba8388684ef8211a7c58c087b9f5e8 verified. Its setup_page.py bytes match final Git. The installed proof records a fresh guest venv outside source and matching renderer/HTML; rendered proof selects the same six command blocks. This is scoped installed-renderer acceptance, not a newly rebuilt final whole-wheel claim.
• Dedicated CI run 40357278137, attempt 1, completed October 26, 9:15:42 AM PDT. Independent reviewer read the source/workflow and raw job/artifact. I separately downloaded and verified the 50,378-byte ZIP, SHA 075b700045003ce21e41b60fbf972156a3896384b913f8c7dc85641e91ae1f0d, and the actual normal/injected/store outcomes. The real store guest is Debian 13.7, not an Ubuntu desktop; its Ubuntu 24.04 runner is only the orchestrator.
• Exact rendered commands passed duplicate-name, non-root-denial, concatenated-input, root-owned0644 install, trusted-chain, wrong-CA/hostname, existing-file and backout checks. The injected invocation remains exit1 / failed, with its primary RuntimeError intact and successful cleanup separately recorded. Before/after trust-bundle hashes match and the synthetic destination is absent.
• Retained final report SHA 291e7987209c3ad70ae6461b36940169258395b16f2e1105acf2465d6e74716f and 3,081,402-byte archive SHA 76f3efb6b36422397ec1ae83e1d8d5734a10680d78a3a96ccf71194eec157920 match; all 123 archive file members match retained local bytes. Managed destroy-confirmed/backend-removed receipts bind the exact owner/resource, and CI raw stop/removal/empty-inventory evidence is retained. No fresh physical census or repeat tests were performed by this review.

Limits and disposition

Earlier source-review defects and intentionally failing controls remain preserved. Root-invoked sudo does not test interactive user authentication. Actual Edge/Firefox/Snap trust, the Thinkstation imported CA identity and its browser error remain open; this PR is not represented as fixing that live incident. Source/installed screenshots and exact DOM selection evidence are retained; the direct parent image-delivery pair was unavailable, so I make no new parent pixel-comparison claim. The owner retained both its full-page analysis disagreement and targeted crop review.

Releases retains current-main integration, required CI/independent approval, version and publication. Do not repeat the successful CA job merely for reporting, and do not substitute unrelated green Fast/iOS checks for the explicit Linux evidence above. The original owner retains worktree/evidence custody. No host trust changes, service restart, live update, or archive of an unshipped owner is authorized by this handoff.

[Brian Krabach (bkrabach)]

Releases has received the direct human instruction and integrated this exact accepted candidate into release PR #1205 (0.32.0), currently d840d26. Independent source/assembly/static review found no blocker; required Fast is green and the affected combined installed-package qualification is in progress. Normal independent approval is requested; no administrative bypass or live adoption. Please retain original evidence/failed records and avoid a competing release or implementation owner. This source PR remains open until actual publication is verified.

[Brian Krabach (bkrabach)]

Shipped in v0.32.0 through integrated release PR #1205. Published tag a50619f has the exact qualified tree d10c29ac277ee5c6d2a628807710c5d39e4d303a; all accepted non-static author blobs were preserved. Publisher 40494998201 completed all five jobs successfully. The actual downloaded wheel matches qualified SHA-256 24f0b5af983a04ce6382019fb3f6b919266233965ea3c807e9e7068e696a82c6. Closing as shipped, not merging this source branch again. Original evidence, failures, skips, limitations and author ownership remain intact. No live installation, service restart, trust-store change or Thinkstation retry occurred. Broad post-release run 40495284762 is monitored separately and is not yet a reported pass. Release: https://github.com/microsoft/amplifier-unified/releases/tag/v0.32.0