# Linux dependency setup — Codex-956atf, 2026-09-11

Owner: Codex-956atf `/root/linux_dependency_setup`, bounded guest package and
toolchain lease. This record applies only to root's Ubuntu-26.04 WSL2 host;
other teams' environments and previous Ubuntu24.04 acceptance remain separate.
Root owns all Cargo compilation, native application checks and release claims.

**Setup completed successfully.** Both installation scripts exited0. No guest
mutation remains under this worker; root received the explicit safe boundary
for the user's next networking restart. No application compilation was run.

## Prepared and verified

The installed Ubuntu guest contains `gpgv`, Python3 and the original
`/usr/share/keyrings/ubuntu-archive-keyring.gpg`. Windows HTTPS downloads supplied
the official `resolute`, `resolute-updates` and `resolute-security` InRelease
files and their main/universe amd64 Packages.xz indexes. SHA256 values for every
compressed index matched the signed release metadata. Guest `gpgv` accepted all
three signatures from Ubuntu Archive Automatic Signing Key (2018), fingerprint
`F6ECB3762474EDA9D21B7022871920D1991BC93C`.

Guest APT then successfully imported these same indexes through an isolated
`file:` source, with its normal signature/hash enforcement, and resolved the
README/provision.sh native prerequisites. No unsigned/trusted/insecure override
was used. Existing system APT sources were not changed. Temporary source/cache
configuration lives in `/var/tmp/arcadia-956atf-apt`; original source and network
failure logs remain in the parent setup directory. The recurring root systemd
user-session warning did not prevent the commands completing with exit0.

All **462** registry archives in the exact archived `8d55d2d` Cargo.lock have
been staged and checked against its SHA256 checksums: 421 reused from the host
cache and 41 downloaded from the ordinary official crates.io distribution
endpoint. Only required sparse-index entries and a public registry config were
copied; no credentials or broad Cargo home were transferred. This is cache
preparation, not evidence that Cargo has resolved or compiled on Linux.

The official Rust1.98.1 manifest SHA256 is
`a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e`,
matching its independently downloaded HTTPS publisher checksum. Native Linux
component downloads use the manifest's exact dated URLs and SHA256 values.
All five required Linux component payloads now match the manifest. The77
APT-resolved .debs total121,298,540 bytes; Rust manifest/checksum/components
total130,891,416 bytes;462 crate archives total71,341,076 bytes.

## Installed native dependencies

The guest independently rehashed all77 .debs before ordinary APT installation.
`install-apt.sh` completed exit0, including `dpkg --audit` with no findings and
actual native version queries:

| Tool/library | Installed version |
| --- | --- |
| cc (Ubuntu GCC) | 15.2.0-16ubuntu1 |
| pkg-config | 2.5.1 |
| xkbcommon | 1.13.1 |
| wayland-client | 1.24.0 |
| vulkan | 1.4.341 |
| x11 | 1.8.13 |

`install-apt.log` preserves the full successful install and queries;
`installed-packages.tsv` preserves exact package versions and architectures.
All five official Rust component installers then completed successfully. The
worker copied the targeted Cargo registry into the native Linux filesystem and
rehashed all462 installed archive payloads successfully. Actual version queries
completed with exit0:

| Tool | Version/identity |
| --- | --- |
| rustc | 1.98.1, commit48a229ceaefd4985c50990b14116b6d856af0985, 2026-09-01 |
| native Rust host | x86_64-unknown-linux-gnu |
| LLVM | 22.1.8 |
| cargo | 1.98.1, commit797e8a9bca276c1c9f9f738d2a20f484fa4eea9d |
| rustfmt | 1.9.0-stable |
| clippy | 0.1.98 |

`install-rust-cache.log` preserves installers, independent guest input and
installed-cache verification, and full version output.
`installed-rust-bin-sha256.txt` records the installed rustc, Cargo, rustfmt and
Clippy-driver binary hashes. Prefix: `/opt/arcadia-956atf/rust-1.98.1`;
`CARGO_HOME=/opt/arcadia-956atf/cargo`. Source `/opt/arcadia-956atf/env.sh` to select
them in one guest shell. No rustup or user account was needed.

Installed rustc binary SHA256:
`859254978c0a0402c32f949f6de0d99aee73be8d15f45aac00ae1448aac51e74`.
Installed Cargo binary SHA256:
`da77c8b33849312255ccde3179198ada4c8deb370488d050286146b1d1b27e14`.
Successful APT log SHA256:
`e42bb5583896d4d59b2c9c0e079e08cb77b1eff12c6d6c7092256ab7567ad357`.
Successful Rust/cache log SHA256:
`221665be74dd00ccdfb7b2897afac0aef178114b63c7ecbed38607dfeecb09ea`.
Installed package inventory SHA256:
`8f54a21307b0e48218b4ea14aba1b39f97c4deb500f212fee1622a9a6aa74d33`.
Final observed host C free capacity:22,014,636,032 bytes.

## Private evidence and commands

Everything below is under ignored
`.local/wsl-956atf-20260911/dependencies/` unless noted:

- `metadata-manifest.json`, `prepare-apt.log`, `package-uris.txt` preserve exact
  Ubuntu metadata hashes, accepted signatures and APT resolution.
- `ubuntu/` is the task-local original signed metadata and complete77-package mirror.
- `cargo-cache-complete-manifest.json`, `complete-cargo-cache.log`, `cargo/`
  preserve all 462 verified archives and targeted registry index inputs.
- `channel-rust-1.98.1.toml`, its `.sha256`, `rust/`, `fetch-rust.log` preserve
  official Rust component inputs. `rust-manifest.json` is written only after
  every required component hash passes.
- `fetch.py`, `prepare-apt.sh`, `install-apt.sh`, `install-rust-cache.sh`,
  `prepare-cargo-cache.py`, `complete-cargo-cache.py` preserve the preparation
  and installation commands. Install scripts recheck every payload hash in
  the guest before installation.

The completed verification manifest SHA256 values are:

| Manifest | SHA256 |
| --- | --- |
| metadata-manifest.json | 93871f3a04cc6ac78d65437a4d3d48fc99b920dd77f4750d86422b9778650354 |
| packages-manifest.json | 141d47332706296b3cc63ff87708007aa41d532de725ef5cb49bfac17b310c58 |
| rust-manifest.json | 4b7876afca1cae0f774cd878c35f80848c9dff9078827a0f83ccadf3dba02da1 |
| cargo-cache-complete-manifest.json | f4e8abe305b0ce3933c0d0d195786bd8abf1f642788c3d6d9bcc06e6f19edb17 |

Initial package download parsing encountered Windows' default CP1252 decoder;
the loader now explicitly reads Ubuntu indexes as UTF-8. The failed log is
`fetch-packages.log`. Subsequent Windows default-address connection timeouts
are retained in `fetch-packages-retry.log`. A bounded explicit IPv4 request for
the same build-essential package returned HTTP200 from `91.189.91.83`, 5158
bytes in0.960098s; the next download pass selects IPv4, leaving all TLS/signature
and hash checks intact. No OS networking setting was changed by this worker.

## Coordinated pause and root handoff

Root requested a safe guest pause to apply the user's issue1/comment316
mirrored networking plus DNS tunneling instructions. The sole guest APT
preparation command had already completed exit0; no apt/dpkg/install process
or guest mutation was active when the safe acknowledgment was sent. Windows
downloads completed independently. Root then applied the user's exact
configuration and performed `wsl --shutdown`, started a read-only network probe,
and explicitly released the guest lease. The worker started sequential offline
APT/toolchain installation. Both scripts are now terminal exit0, and root has
received the safe no-active-mutation acknowledgment.

Root retains the later user issue1/comment328 VirtioProxy request and may now
perform its separately authorized restart. This worker neither inspects nor
changes the immutable host VPN. Earlier guest networking remains unaccepted;
dependency installation did not depend on it working.

The prepared first native build command below is now ready for root. It has
**not** been executed by this worker.
The archive pins8d55d2d and deliberately excludes later uncommitted focus and
isolated schema8/canvas source. Use another explicit archive and fresh source/
target directory when validating later source.

```sh
. /opt/arcadia-956atf/env.sh
mkdir /opt/arcadia-956atf/source-8d55d2d
tar -xf /mnt/c/Users/User/Documents/Git/ARCADIA-Studio/.local/wsl-956atf-20260911/source-8d55d2d.tar \
  -C /opt/arcadia-956atf/source-8d55d2d
cd /opt/arcadia-956atf/source-8d55d2d
CARGO_BUILD_JOBS=1 CARGO_TARGET_DIR=/opt/arcadia-956atf/target-8d55d2d \
  cargo build --locked --offline --workspace --bins
```

Archive SHA256:
`b7a11cc7f0ac56c0f8fded46b040665ae75ee55775ae429dfc8579a5d51ead57`.
The resulting profile would be development; use an explicit separate optimized
build for release packaging. Native tests, CLI/server smoke checks, WSLg/portal
GUI checks, current-source integration and Ubuntu24.04 compatibility remain
root-owned acceptance gates. No compilation or application runtime result is
established by dependency installation.