# Offline Linux inputs on Codex-ytr83r — 2026-09-11

## PAUSED BY USER — authoritative final status

The user suspended Linux builds/checking until they resolve networking and explicitly instruct resumption. All Linux preparation/download work is paused as well. This is **PAUSED BY USER**, not blocked, failed or ready for installation. Do not resume downloads, installation, builds or checks automatically. Windows work is separate.

Worker stopped only its owned Python download PID8064; stop command exited0 and download session91581 terminated with exit1 from the intentional stop. A final read-only process audit found zero matching owned download processes. Root separately owns guest Rust-installer cleanup; worker performed no guest action, and root reports no APT installation began.

Frozen deb subset: **11 of76 complete,14,602,928bytes**, each independently rehashed against its signed-index SHA256; **65 archives remain incomplete or not started**. Two partials are preserved and not admitted: g++-15-x86-64-linux-gnu6,553,600B, SHA256 `a5d2b67ca634ad1b1715a5e95eef54e84327595ee5d30865b79b2195ef4b1c39`; gcc-15-x86-64-linux-gnu5,505,024B, SHA256 `0147c2d57ae11ed22bfd0d1cc625c93557482e1d80f55da0b9c5018ecd4b6975`. No retry, queued transfer or new download was started after cleanup. `paused-by-user.json` records complete filenames/hashes, remaining names, partial sizes/hashes, process/session cleanup and the resumption condition. Earlier completed Rust/Cargo/Ubuntu metadata inputs remain preserved, not installed or accepted by this worker.

The sections below preserve preparation history. Their earlier pending/active transfer wording is superseded by this user pause.

Owner: Codex-ytr83r `/root/linux_build_plan`; root owns persistent Ubuntu shell93868, Windows Cargo83906 and all guest installation/build/native work. Source freeze `29084050a7c020e0fb488be37c6e1ab235769cc0`. Coordination read314/324/328 onward; ownership334. The worker owns only this report and `.local/linux-offline-preparation-ytr83r/`. No WSL, apt/dpkg, compiler, guest/root configuration, host networking or VPN inspection/modification, Git mutation, upload or release was performed by the worker.

## Current preparation checkpoint

Native Rust components and Cargo offline inputs are complete. Three Ubuntu signed releases and six main/universe amd64 indices are complete. Exact dependency closure/download waits for root's isolated APT update and URI selection against this guest's installed state; no guessed77-package list from another host is reused.

Initial local inventory found no peer offline deb/Rust payloads. This host had29,176,729,600B free C: and2,628,736KiB free RAM; later free C:28,837,474,304B. Downloads used ordinary Windows HTTPS with two metadata transfers at most, then one Rust component transfer at a time alongside the root compiler. Source archives are reused only after independent Cargo.lock checksum verification; no Windows compiled objects, linker, user Cargo configuration or credentials are copied.

## Trust and exact inputs

Fresh official `archive.ubuntu.com` base/updates and `security.ubuntu.com` security InRelease files are preserved without rewriting. Worker initially recorded hashes only and explicitly deferred signature validation. Root then ran guest `gpgv` with the distro-installed `/usr/share/keyrings/ubuntu-archive-keyring.gpg`; `guest-state/signatures.log` ends `ARCADIA_SIGNATURES_DONE` and records three exit0 good signatures from Ubuntu Archive Automatic Signing Key2018, fingerprint `F6ECB3762474EDA9D21B7022871920D1991BC93C`. The worker read that terminal log and matched all three hashes:

| Suite | InRelease SHA256 |
| --- | --- |
| resolute | 45f95ce276cdba3e41870516a130e03c58b8b7a79e9546b0efe9e526d255740c |
| resolute-updates | e9fa3064b816cb6d933ad1955a0a98a85adb64a0cec7f0790c81fa07e671db90 |
| resolute-security | 61451f547f1b68392fc1c17c2d26dcf970abb94745de873584b46711537daa96 |

Six amd64 main/universe `Packages.xz` files were fetched using immutable publisher `by-hash/SHA256` URLs bound to those releases. Both compressed and decompressed lengths and SHA256 values match their InRelease records. Exact URLs/hash/size/release associations live in `ubuntu-indices.json`; normal paths and unchanged signed releases are staged under `mirror/dists/`. Restricted/multiverse/backports are not needed for the requested build/runtime package set unless APT reports otherwise; none were guessed or fetched. [Ubuntu apt-secure](https://manpages.ubuntu.com/manpages/resolute/man8/apt-secure.8.html) describes this signed-release → index-hash → package-hash chain; package archive hashing alone is not signature validation.

Official `channel-rust-1.98.1.toml` matches its separately fetched publisher HTTPS SHA256 `a7c8774a5fd8441c997d94c029776cbc5eb111e9d72ab5d256fa69866644347e`; date2026-09-03. All five x86_64-unknown-linux-gnu components match its exact xz hashes:

| Component | Bytes | SHA256 |
| --- | ---: | --- |
| rustc | 79727616 | e974f036b28565f37c0f3bd92ddefa809bee16c04f9dcf07b9ed96e05aaaf7c4 |
| cargo | 11662108 | ea1de9f9e23107d97ee2b41a72c552f34064a593da503789218387aee59f3ba4 |
| rust-std | 30715684 | fa3ff450172a16c026944030230c5069947af93c728d9179971d44e5e0cfb561 |
| rustfmt | 2486356 | b29a1addcbf2aa8f5785075605700e63cbe131b08c8334b50c09cfca8bbc51dc |
| clippy | 5400924 | e167f333be24e1d5eea56ea563c7def0aa0bd613f5ce3445976c93b0288799d1 |

`rust-components.json` and `rust-transfer.json` record official dated URLs, times and hashes. This establishes publisher HTTPS checksum verification, not independent Rust OpenPGP verification. Root must inspect/install these ordinary distribution components under a task prefix and verify actual compiler/notices; the worker ran no install script or Rust binary.

## Cargo reuse without Windows build inputs

All460 registry archives in this freeze's Cargo.lock were present locally and independently matched their locked SHA256. Each corresponding sparse-index record was parsed and its exact name/version/checksum matched the lock. The only copied registry configuration is public `config.json` with standard crates.io download/API URLs; no config.toml or credentials file is read/copied. Selected427 sparse-index files plus that public config and460 archives form888 files in `cargo-registry-offline.tar`.

Archive size101,079,040B, SHA256 `78b498b66b737a43439d396cb66be89185edc85645707896caf6815aec8cc7a5`. Every tar member was read back and compared against its expected hash; no extra/duplicate member admitted. `cargo-bundle.json` records every member's hash and `cargo-cache-audit.json` every locked package/source path. Root can extract into an empty Linux task CARGO_HOME, retaining a separate Linux target directory. This is a conservative cross-platform locked-source superset; no worker Cargo metadata/target-graph execution occurred. Actual Linux offline resolution remains root's gate.

## Guest facts and isolated APT selection

Root saved completed `guest-state/inventory.log` and `packages.tsv` through the sole persistent guest shell. Actual guest Ubuntu26.04/resolute, amd64, gpgv present; only old April20 main/restricted package indices existed, with Universe absent. Therefore the old guest lists could not resolve the full dependency request accurately.

Prepared task-only `apt.sources.list` uses file mirror suites base/updates/security, main/universe, amd64 and the existing archive key. `apt.conf` points source list/parts and cache/list files to task paths under `/var/tmp/arcadia-offline-ytr83r`, leaving system sources, installed dpkg state and trust intact. It requests only Packages indices, no translations/command-not-found/icons, and disables by-hash acquisition for the local filenames while preserving signed-release checksum enforcement. No trusted=yes, allow-unauthenticated, insecure repository, new key, expired-release bypass or network workaround is used.

Root must run `apt-get -c <staged apt.conf> update` and preserve exit/log, then use the same config with `--print-uris --yes --download-only --no-install-recommends install` for the README build dependencies plus Git/certificates/curl/Python/jsonschema/file/Mesa. The exact command was handed to root. [apt-get documentation](https://manpages.ubuntu.com/manpages/resolute/man8/apt-get.8.html) defines print-URIs selection instead of downloading. The worker will map each selected pool path/size to a SHA256 in the verified index before fetching it; final APT install is root-owned and must retain normal signature/hash validation.

No package download, guest install/build, WSLg/native acceptance or network success is inferred at this checkpoint. Ubuntu26.04 evidence does not establish the older Ubuntu24.04 packaging baseline. The preparation script preserves existing/partial files and refuses silent overwrite; failed inputs require explicit diagnosis rather than unsafe fallback.

## Root update and installer source review

Root's isolated APT update later completed `APT_UPDATE_EXIT=0`, after all six local Packages acquisitions. Its log also contains `Error: Timeout was reached` before `Reading package lists...`; preserve this mixed result without assigning a cause. Root is inspecting existing ancillary hooks/index trust and selecting URIs. No deb download begins before the completed selection is reconciled with the six fixed signed indices.

Read-only Windows tar inspection of all five Rust archives found exactly the expected top-level directory per archive, no symbolic/hard links and no absolute/traversal member paths. The rustc archive contains both `rustc/share/doc/rust/COPYRIGHT.html` and `COPYRIGHT-library.html` needed by strict packaging. `rust-review.json` preserves the inventory; normalized local install.sh source copies are in `rust-review/` (copies are for reading, never the files to execute).

The official installers declare Bash. Source lines789–813 make prefix-controlled bin/lib/etc/share paths and support `--disable-ldconfig`; lines654–692 gate Linux linker configuration on that flag. They can replace existing components, so the prepared driver requires fresh toolchain, Cargo and unpacked paths rather than reusing an existing installation. Actual installation must run the original archive installer, not the normalized review copy.

Prepared `install-rust-for-root.sh`, SHA256 `1EBA4BA6AEF9CC74C85778D0E6A6BCECE66EA572CB5826FE4BF958909F424772`, is **not executed by this worker**. Root can syntax-review it and run it through the existing guest shell when appropriate. It verifies `rust-cargo-SHA256SUMS`, creates fresh `/root/arcadia-linux-ytr83r-29084050/{unpacked,cargo,toolchain,evidence}`, extracts each ordinary component archive, invokes `bash <original install.sh> --prefix=<task toolchain> --disable-ldconfig`, saves per-component logs, extracts the verified Cargo cache tar and checks copyright reports/version output. Its final build-shell guidance uses only task PATH/CARGO_HOME/CARGO_TARGET_DIR; HOME, CODEX_HOME, RUSTUP_HOME and profiles are untouched. This is an installer preparation/source review, not a Linux toolchain execution or offline Cargo pass.

## Exact APT closure admitted for download

Root's completed `apt-index-check.log` reports all six indices `Trusted: yes`, and the worker read those entries. The unchanged system `20packagekit` post-invoke hook invokes `gdbus ... --timeout 4`; this is a plausible explanation for the generic timeout preceding update exit0, not a reproduced causal result. Neither hooks nor network configuration were changed.

Completed `apt-uris.log` ends `APT_URIS_EXIT=0`, SHA256 `58bb654dc064e2689ff25229678cdfebad041ccdb7b7dbb20af5249a070f939d`. Its exact closure is **76 archives /120,887,638bytes:61 newly installed,15 upgraded,0 removed,139 not upgraded**. APT estimates316MB additional installed disk space. Git, Python3, python3-jsonschema and file are already newest. Before downloads this host had28,535,529,472B free C:.

The15 upgrades are ca-certificates, curl, libbz2-1.0, libc-bin, libc-gconv-modules-extra, libc6, libcurl3t64-gnutls, libcurl4t64, libegl-mesa0, libgbm1, libgl1-mesa-dri, libglx-mesa0, locales, mesa-libgallium and mesa-vulkan-drivers. This includes glibc and Mesa updates from the newer signed repository state; it is not an install-only transaction. Root received the scope before any guest installation. No full upgrade/removal was requested.

Worker reconciled every exact APT-selected pool filename/size against the fixed verified indices, retaining package/version/architecture, source suite, index hash and InRelease hash in `deb-plan.json`. APT's printed MD5 identifiers are not the integrity boundary: each download is checked against the SHA256 carried by signed metadata. Exactly these76 official HTTPS archives are now transferring into `mirror/pool`, at most two concurrently. No archive installation or completed-dependency claim yet; failed/partial downloads remain preserved for diagnosis.