research: publish canonical pilot v1 repeat stability snapshot

.github/workflows/research-repeat-v1.yml

@@ -11,12 +11,14 @@ on:
       - "scripts/research/run-repeat-v1.sh"
       - "scripts/research/analyze-repeat-v1.py"
       - "scripts/research/project-repeat-manifest-v1.py"
+      - "scripts/research/verify-repeat-snapshot-v1.py"
       - "scripts/research/materialize-v1.sh"
       - "scripts/research/verify-materialization-v1.sh"
       - "scripts/research/verify-profile-lock-v1.sh"
 
 permissions:
   contents: read
+  actions: read
 
 env:
   GO_VERSION: "1.25.14"
@@ -39,6 +41,7 @@ jobs:
           bash -n scripts/research/run-repeat-v1.sh
           python3 -m py_compile scripts/research/analyze-repeat-v1.py
           python3 -m py_compile scripts/research/project-repeat-manifest-v1.py
+          python3 -m py_compile scripts/research/verify-repeat-snapshot-v1.py
           python3 scripts/research/analyze-repeat-v1.py --self-test
           python3 scripts/research/project-repeat-manifest-v1.py --self-test
           jq -e . research/repeat/v1/stability-sample.json >/dev/null
@@ -84,6 +87,23 @@ jobs:
           print("[research-repeat-v1] sample bindings PASS")
           PY
 
+      - name: Download canonical repeat artifact
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          artifact_id="$(jq -r '.actions_artifact.id' research/repeat/v1/repeat-dataset-manifest.json)"
+          [[ "$artifact_id" == "10584409793" ]] || {
+            echo "::error::unexpected canonical repeat artifact id: $artifact_id"
+            exit 1
+          }
+          gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts/${artifact_id}/zip" > /tmp/research-repeat-v1.zip
+
+      - name: Verify committed repeat snapshot
+        run: >-
+          python3 scripts/research/verify-repeat-snapshot-v1.py
+          --artifact-zip /tmp/research-repeat-v1.zip
+
   execute:
     name: Execute 21-attempt repeat stability sample
     if: github.event_name == 'workflow_dispatch'

research/ARCHIVAL.md

@@ -13,8 +13,14 @@ research archive. It is an engineering reproducibility policy, not legal advice.
 - planned/observed executions: **70/70**
 - repository dataset: `research/data/v1/`
 - deterministic analysis: `research/analysis/v1/`
-- repeat-run protocol: merged in PR #152; the manual 21-attempt execution is
-  still required before the research archive is frozen.
+- canonical repeat workflow run: `35445834557`
+- repeat source commit: `d2a78e05178ea6dd82ead9684f5eedf49066903f`
+- repeat Actions artifact: `10584409793`
+- repeat artifact SHA-256:
+  `895fd41dae147c592d5cdec91bbd99150f9dd14c35afadf72bc14954a192a0e5`
+- repeat stability: **21/21** stable on the same exact environment,
+  **0** environment drift, **0** same-environment verdict instability
+- repeat repository snapshot: `research/repeat/v1/`
 
 ## Archive layers
 

research/README.md

@@ -30,8 +30,9 @@ Repository snapshot and integrity metadata:
   raw-report checksums, and dataset manifest;
 - [`analysis/v1/`](analysis/v1/) — deterministic descriptive RQ1–RQ4 tables
   and machine-readable analysis summary;
-- [`repeat/v1/`](repeat/v1/) — merged post-collection stability protocol; the
-  manual 21-attempt execution is still pending;
+- [`repeat/v1/`](repeat/v1/) — canonical post-collection stability snapshot:
+  21/21 attempts stable on the same exact environment, with 0 environment drift
+  and 0 same-environment verdict instability;
 - `scripts/research/analyze-study-v1.py` — analysis generator;
 - `scripts/research/test-analysis-v1.sh` — checksum and reproduction gate.
 
@@ -47,8 +48,8 @@ Publication-facing material is kept explicit and evidence-bounded:
   third-party compiled-loader policy;
 - [paper/PREPRINT.md](paper/PREPRINT.md) — working manuscript scaffold whose
   numerical claims are constrained to generated v1 analysis;
-- [ROADMAP.md](ROADMAP.md) — remaining repeat-run, figure, archival, DOI, and
-  external academic-use gates.
+- [ROADMAP.md](ROADMAP.md) — remaining figure, archival, DOI, and external
+  academic-use gates.
 
 No university, lab, course, or paper should be listed as an academic reference
 until a public independent source can be verified. A resource-page link is a

research/ROADMAP.md

@@ -32,9 +32,11 @@
 - [x] Generate pilot v1 descriptive RQ1–RQ4 tables from normalized data.
 - [ ] Generate every final paper table and figure from normalized data.
 - [x] Define a bounded representative repeat-run protocol (PR #152).
-- [ ] Execute the 21-attempt repeat-run workflow from `main`, archive its
-      provenance/results, and evaluate environment drift separately from
-      same-environment verdict instability.
+- [x] Execute the 21-attempt repeat-run workflow from `main`, bind its
+      provenance/results to the repository snapshot, and evaluate environment
+      drift separately from same-environment verdict instability. Canonical run
+      `35445834557`: 21/21 stable same-environment observations, 0 drift,
+      0 verdict instability.
 - [x] Document the v1 execution boundary, KVM/VM prerequisites, exact-environment identity, and collection completeness rules.
 - [x] Publish raw/processed dataset checksums and bind the repository snapshot to
       the canonical successful workflow artifact.

research/paper/PREPRINT.md

@@ -27,7 +27,11 @@ booted 6.12 UEK. Excluding the calibration case, the pilot contains 50 compatibl
 8 of 9 conclusive observations; AlmaLinux 8's observed 4.18 vendor kernel was
 the below-threshold compatible exception. The dataset also contains two
 cross-vendor version inversions in which an older-numbered kernel passed while a
-newer-numbered kernel failed.
+newer-numbered kernel failed. A purposefully stratified post-collection repeat
+sample then reran seven canonical tuples three times each. All 21/21 repeats
+matched the canonical verdict on the same exact environment; no environment
+drift or same-environment verdict instability was observed in that bounded
+sample.
 
 These results are descriptive evidence from a selected pilot, not population
 estimates for Linux deployments. The study publishes normalized evidence,
@@ -113,8 +117,20 @@ release, image SHA-256, exact environment ID, and evaluability.
 
 ### Table 4 — repeat-run stability
 
-Populate only after the merged PR #152 manual workflow is executed. Separate
-environment drift from same-environment verdict instability.
+Canonical repeat run `35445834557` executed seven purposefully selected tuples
+three times each:
+
+| Measure | Result |
+| --- | ---: |
+| Planned attempts | 21 |
+| Observed attempts | 21 |
+| Stable on the same exact environment | 21 |
+| Environment drift | 0 |
+| Same-environment verdict instability | 0 |
+
+This table is a bounded stability check, not an estimate of a population-wide
+nondeterminism rate. The source of truth is
+`research/repeat/v1/data/stability-summary.json`.
 
 ## Limitations
 
@@ -131,7 +147,7 @@ environment drift from same-environment verdict instability.
 
 Do not convert this working draft into a submission-ready manuscript until:
 
-1. the 21-attempt repeat-run stability sample is executed and archived;
+1. the committed 21-attempt repeat-run stability snapshot remains verifiable;
 2. final figures/tables are generated from normalized data;
 3. the v1 archival/redistribution manifest passes;
 4. a research-tagged immutable release is created;

research/repeat/v1/README.md

@@ -42,15 +42,32 @@ the exact environment ID and normalized verdict match.
 The workflow is manual-only because it boots real vendor VMs and is intended as
 a bounded research validation, not a routine CI gate.
 
-## Run
+## Canonical repeat collection
 
-After this protocol lands on `main`:
+The canonical successful repeat collection is GitHub Actions run
+`35445834557` at commit
+`d2a78e05178ea6dd82ead9684f5eedf49066903f`. Its Actions artifact is
+`10584409793` with SHA-256
+`895fd41dae147c592d5cdec91bbd99150f9dd14c35afadf72bc14954a192a0e5`.
 
-```bash
-gh workflow run research-repeat-v1.yml --repo Kernel-Guard/bpfcompat --ref main
-```
+The run completed all **21/21** planned attempts across the seven frozen sample
+tuples. All 21 observations reproduced the canonical verdict on the same exact
+environment. Environment drift was **0** and same-environment verdict
+instability was **0**.
 
-The workflow publishes raw repeat reports, logs, repeat-only manifest
-projections and their provenance metadata, a repeat provenance record,
-`repeat-executions.jsonl`, `stability-summary.json`, and generated
-`RESULTS.md` as a staging Actions artifact.
+Repository evidence:
+
+- `repeat-dataset-manifest.json` binds the canonical run and Actions artifact;
+- `data/stability-summary.json` preserves the generated tuple-level result;
+- `data/repeat-provenance.json` binds the runner inputs and binary identities;
+- `data/raw-report-checksums.json` freezes all 21 raw report paths and hashes;
+- `data/projection-metadata/` preserves the repeat-only manifest projections;
+- `scripts/research/verify-repeat-snapshot-v1.py` verifies the committed hash
+  and provenance chain.
+
+The row-level `repeat-executions.jsonl`, raw reports, VM logs, and generated
+projection YAMLs remain in the content-addressed workflow artifact for later DOI
+archival rather than being duplicated into Git history.
+
+The earlier manual run `35443831085` is diagnostic only: it exposed the
+singleton-matrix/manifest scheduling bug and is not part of the repeat dataset.

research/repeat/v1/data/RESULTS.md

@@ -0,0 +1,11 @@
+# Pilot v1 repeat-run stability
+
+This is a purposeful post-collection stability sample, not a random population sample.
+
+- Planned attempts: 21
+- Observed attempts: 21
+- Stable on the same exact environment: 21
+- Environment drift: 0
+- Verdict instability on the same environment: 0
+
+Environment drift is kept separate from verdict instability.

research/repeat/v1/data/projection-metadata/inconclusive-oracle-environment.json

@@ -0,0 +1,25 @@
+{
+  "profile_id": "oracle-linux-9-uek7-5.15",
+  "projected_path": "reports/research-repeat-v1/manifests/inconclusive-oracle-environment.yaml",
+  "projected_required_profiles": [
+    "oracle-linux-9-uek7-5.15"
+  ],
+  "projected_sha256": "sha256:72c544536b5e081353b50d45842969b111240e4b13ed1d0dc5ed59b5ba5ba301",
+  "projection": "required_profiles_singleton",
+  "schema_version": "bpfcompat.research.repeat-manifest-projection.v1",
+  "source_git_blob": "f813d866b40469815699577ab15ee9b4881e3d3c",
+  "source_path": "research/corpus/v1/manifests/simple-pass.yaml",
+  "source_required_profiles": [
+    "ubuntu-20.04-5.4",
+    "ubuntu-20.10-5.8",
+    "ubuntu-22.04-5.15",
+    "debian-12-6.1",
+    "ubuntu-24.04-6.8",
+    "almalinux-8-4.18",
+    "amazon-linux-2-4.14",
+    "amazon-linux-2-5.10",
+    "oracle-linux-9-uek7-5.15",
+    "opensuse-leap-15.6-6.4"
+  ],
+  "source_sha256": "sha256:c2c210941988588e7299bf8e69f1b7c0b643057225a9fe7532a46578622f5dcb"
+}

research/repeat/v1/data/projection-metadata/negative-ringbuf-boundary.json

@@ -0,0 +1,25 @@
+{
+  "profile_id": "ubuntu-20.04-5.4",
+  "projected_path": "reports/research-repeat-v1/manifests/negative-ringbuf-boundary.yaml",
+  "projected_required_profiles": [
+    "ubuntu-20.04-5.4"
+  ],
+  "projected_sha256": "sha256:7134def39ea8204916fb24ae4690d759e21f6b97c4f3b0a23a233c573a7b85de",
+  "projection": "required_profiles_singleton",
+  "schema_version": "bpfcompat.research.repeat-manifest-projection.v1",
+  "source_git_blob": "e639703c69bc49130f1959a095f5fe8befcec0bd",
+  "source_path": "research/corpus/v1/manifests/ringbuf-modern.yaml",
+  "source_required_profiles": [
+    "ubuntu-20.04-5.4",
+    "ubuntu-20.10-5.8",
+    "ubuntu-22.04-5.15",
+    "debian-12-6.1",
+    "ubuntu-24.04-6.8",
+    "almalinux-8-4.18",
+    "amazon-linux-2-4.14",
+    "amazon-linux-2-5.10",
+    "oracle-linux-9-uek7-5.15",
+    "opensuse-leap-15.6-6.4"
+  ],
+  "source_sha256": "sha256:1a39b0164114981cb336cc864caedbd69302b3bf8397d964a77757fae59a48a0"
+}

research/repeat/v1/data/projection-metadata/positive-controlled-modern.json

@@ -0,0 +1,25 @@
+{
+  "profile_id": "ubuntu-22.04-5.15",
+  "projected_path": "reports/research-repeat-v1/manifests/positive-controlled-modern.yaml",
+  "projected_required_profiles": [
+    "ubuntu-22.04-5.15"
+  ],
+  "projected_sha256": "sha256:b786af1a52de3fb51d97581591166e94b788ee1795bbad5fff9ba4bd1f29fc88",
+  "projection": "required_profiles_singleton",
+  "schema_version": "bpfcompat.research.repeat-manifest-projection.v1",
+  "source_git_blob": "f813d866b40469815699577ab15ee9b4881e3d3c",
+  "source_path": "research/corpus/v1/manifests/simple-pass.yaml",
+  "source_required_profiles": [
+    "ubuntu-20.04-5.4",
+    "ubuntu-20.10-5.8",
+    "ubuntu-22.04-5.15",
+    "debian-12-6.1",
+    "ubuntu-24.04-6.8",
+    "almalinux-8-4.18",
+    "amazon-linux-2-4.14",
+    "amazon-linux-2-5.10",
+    "oracle-linux-9-uek7-5.15",
+    "opensuse-leap-15.6-6.4"
+  ],
+  "source_sha256": "sha256:c2c210941988588e7299bf8e69f1b7c0b643057225a9fe7532a46578622f5dcb"
+}

research/repeat/v1/data/projection-metadata/positive-ringbuf-backport.json

@@ -0,0 +1,25 @@
+{
+  "profile_id": "almalinux-8-4.18",
+  "projected_path": "reports/research-repeat-v1/manifests/positive-ringbuf-backport.yaml",
+  "projected_required_profiles": [
+    "almalinux-8-4.18"
+  ],
+  "projected_sha256": "sha256:dcb56ff7c7f7c5473b955d007f04d2f36fa96da3dfa8052b5678cbc93a496621",
+  "projection": "required_profiles_singleton",
+  "schema_version": "bpfcompat.research.repeat-manifest-projection.v1",
+  "source_git_blob": "e639703c69bc49130f1959a095f5fe8befcec0bd",
+  "source_path": "research/corpus/v1/manifests/ringbuf-modern.yaml",
+  "source_required_profiles": [
+    "ubuntu-20.04-5.4",
+    "ubuntu-20.10-5.8",
+    "ubuntu-22.04-5.15",
+    "debian-12-6.1",
+    "ubuntu-24.04-6.8",
+    "almalinux-8-4.18",
+    "amazon-linux-2-4.14",
+    "amazon-linux-2-5.10",
+    "oracle-linux-9-uek7-5.15",
+    "opensuse-leap-15.6-6.4"
+  ],
+  "source_sha256": "sha256:1a39b0164114981cb336cc864caedbd69302b3bf8397d964a77757fae59a48a0"
+}

research/repeat/v1/data/raw-report-checksums.json

@@ -0,0 +1,27 @@
+{
+  "schema_version": "bpfcompat.research.repeat-raw-checksums.v1",
+  "count": 21,
+  "reports": [
+    {"path":"raw/inconclusive-oracle-environment/repeat-1.json","sha256":"sha256:7c2e440a586ce1c35221cbc402556709b972e753d91e8227164d69b5331207cb","size_bytes":3680},
+    {"path":"raw/inconclusive-oracle-environment/repeat-2.json","sha256":"sha256:0ba66a0687db2914bc295d30000f102ade1269fb8c736751c90bb626cde906ac","size_bytes":3680},
+    {"path":"raw/inconclusive-oracle-environment/repeat-3.json","sha256":"sha256:b2a51f2f0bc9d1b036f52307895f6d581cafd8c27acf2fa927e5f3fc1750ec2f","size_bytes":3680},
+    {"path":"raw/negative-falco-real-loader/repeat-1.json","sha256":"sha256:2a2a802239a5159ef54a5ff1840567c5c1b7efc5301a6b6bd68e0b8964a99a30","size_bytes":4386},
+    {"path":"raw/negative-falco-real-loader/repeat-2.json","sha256":"sha256:3c0e3764a010c7fabe6ad56bd80a2b2df6d9851874611121fc60a7b9655c25a6","size_bytes":4386},
+    {"path":"raw/negative-falco-real-loader/repeat-3.json","sha256":"sha256:f43e2673a1ae4df1571ad94bead9d4acfaaf331646a509e70af4c249f3d8a55d","size_bytes":4386},
+    {"path":"raw/negative-ringbuf-boundary/repeat-1.json","sha256":"sha256:6c57fe27727ef6111e9d4a9f5ce9acfacbf76513f22b36554a5439a67a5ed591","size_bytes":4402},
+    {"path":"raw/negative-ringbuf-boundary/repeat-2.json","sha256":"sha256:de7ce80dc46feb42eaa6319f2932ba3af96763290fc40c19a558947538d89b04","size_bytes":4402},
+    {"path":"raw/negative-ringbuf-boundary/repeat-3.json","sha256":"sha256:026d53ede2f95d484068cf9f003e347c6fd60d81fa33669c44e7c4c20844c048","size_bytes":4402},
+    {"path":"raw/positive-cilium-project-loader/repeat-1.json","sha256":"sha256:4199ea28caf34e335313a53ea45be87669e82ed132c74540c54545c97e6fa7a7","size_bytes":3286},
+    {"path":"raw/positive-cilium-project-loader/repeat-2.json","sha256":"sha256:53bc690811e97bea1df88a55e764a65413c41146415369f36285149ea8a892ba","size_bytes":3286},
+    {"path":"raw/positive-cilium-project-loader/repeat-3.json","sha256":"sha256:44c513a3d6386e7f19a1b0a15cbe71dc9aaaa2456735055ad98683c9d9171ffd","size_bytes":3286},
+    {"path":"raw/positive-controlled-modern/repeat-1.json","sha256":"sha256:cedfb535ec3204fff8df2b6b8f94eb23498ea9d5787015d05df10a36b3fd819d","size_bytes":3423},
+    {"path":"raw/positive-controlled-modern/repeat-2.json","sha256":"sha256:1e59171367ad93cc2bb87233b1bee7bbd8f9ea8370ec552c47ca845cf37b3fc4","size_bytes":3423},
+    {"path":"raw/positive-controlled-modern/repeat-3.json","sha256":"sha256:ebc116612557332cb9b46eb60720fb98e75d6d1a51afe3f49eb660c74234da7c","size_bytes":3423},
+    {"path":"raw/positive-falco-real-loader/repeat-1.json","sha256":"sha256:79541b0f295adb81e5fcec66a30bf890367fb435f4d285c962f3a07a31722000","size_bytes":7284},
+    {"path":"raw/positive-falco-real-loader/repeat-2.json","sha256":"sha256:7835ebc6c595972329fb3c7200c877f9b229f078a399d79cceafca5d944d6e91","size_bytes":7284},
+    {"path":"raw/positive-falco-real-loader/repeat-3.json","sha256":"sha256:bfaecccd536fbb70a608247997f39724d0626c61dd6a127b8d0d3bd478abd633","size_bytes":7284},
+    {"path":"raw/positive-ringbuf-backport/repeat-1.json","sha256":"sha256:1f13f4e7d123610f89bab66a6fea0bbddb6b817712e1940633adae368d788146","size_bytes":3552},
+    {"path":"raw/positive-ringbuf-backport/repeat-2.json","sha256":"sha256:e52668535177618250ac18b05e98956d48d48b203ef1ddaeb44f852349713132","size_bytes":3552},
+    {"path":"raw/positive-ringbuf-backport/repeat-3.json","sha256":"sha256:8347013949bf085c8cb32a4e3fe9fe45f56df10749a9ac95f97f90e895ae8d27","size_bytes":3552}
+  ]
+}

research/repeat/v1/data/repeat-provenance.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": "bpfcompat.research.repeat-provenance.v1",
+  "corpus_version": "v1",
+  "workflow_source_commit": "d2a78e05178ea6dd82ead9684f5eedf49066903f",
+  "sample_sha256": "sha256:daf3f51ec5179897d9788c5eed89bbc453690383085043e03eb38034ed54560f",
+  "materialization_sha256": "sha256:a8c3f1745f27037d2cf8cd083176e021497f5b98fe0cd5a9220a10bb2379bab4",
+  "study_plan_sha256": "sha256:90f7562fa331d8f38832e155f2f267e0b35e244417c226245f4d92b523e61408",
+  "profile_lock_sha256": "sha256:702a8beb2859871d69d84f56c37e7ff4b1d1144fc0ccee8788aaee45cc84f63a",
+  "manifest_projection_script_sha256": "sha256:527b041ccc7a2c53282a7f365b2b833a0091600644ba2e33c62d1d72736562e9",
+  "bpfcompat_cli_sha256": "sha256:1365337098474dc0a42484271ee6383d46cb1cd20da09d248f9a0063c5147f0e",
+  "validator_sha256": "sha256:4ae1d5b838be07e6e7c304d753389a239c19eb92f6ba3bd77657e5c9583b9d04",
+  "loaders": {
+    "cilium-ebpf-v022-loader": "sha256:2e0517a0a068cf169ebf6a562cd2354ff9f18da708de7e54af52027a893598a4",
+    "falco-modern-bpf-scap-open": "sha256:736c307379603a8320434217440e346ce03260d31a5e7d58326f5526e2c2f2cd"
+  }
+}