Runtime update trust was supplied afresh to each staging invocation. Add an exclusive, private initial enrollment that binds an independently authenticated root, explicit target/platform/release policy and random enrollment identity. updates:trust requires an independently retained record hash and rechecks the actual stored root, schema, policy and self-signatures. Native Buddy and the standalone CLI share these functions.
The root/policy record is immutable. These commands never refresh SDK metadata, select or install firmware, or advance metadata/release floors. SDK working caches must remain separate. Persistent verified-prefix recovery, key lifecycle, installed/known-good slots and identity-bound boot health remain in #42 and parent #9. Existing image staging still requires explicit caller trust and reports trustStatePersisted: false.
Validation: 29 enrollment/staging tests pass with 207 assertions, including real competing processes and an actual child-only write-limit failure. App/runtime types, Pickier, docs, roadmap and parity checks pass. A hash-checked copy of the compiled CLI completes enrollment/readback and rejects a wrong pin and existing output outside the checkout. All 85 rendered docs pages and 5,944 local links audit cleanly. Independent Spec and Standards reviews found no remaining actionable findings.
The first exact-head CI attempt failed the unchanged native browser scenario's nominal Worker completion guard, tracked in #44. Its original log and artifact are retained. Two separate macOS/Bun1.4.2 observations passed the original assertions (32.90 seconds unchanged, 31.99 seconds with diagnostics); these do not explain Linux/Bun1.4.3's failure. A test-only correction now retains a settled server or DOM observation when its peer stalls, plus the known phase and execution POST count. The original one-second diagnostic budget, 40-second completion guard and authority/admission assertions are unchanged. Its five regression tests pass with 13 assertions; the combined focused run has 34 passes and 220 assertions. Both diagnostic reviews found no actionable issues. This fixes diagnostic loss only, not the original completion failure.
Full exact-head CI for 981e17c succeeded across all five jobs. The native suite reported 1,411 passes, 39 skips, zero failures and 488,367 assertions across 177 files. The exact qualified commit was published to origin/main by a normal fast-forward push as Chris, without coauthor trailers. GitHub reports this PR merged. Initial enrollment and diagnostic correction are published; the remaining #42/#9 coordinator work and the unexplained original #44 failure stay open.