Deferred-runtime (Linux). Checks: kernel lockdown, EFI vars, Secure Boot (mokutil), unexpected services, DNS integrity (flag 102.165.x.x), TLS cipher (flag RC4/MD5/SHA1), world-writable critical paths. Output AttestationDecision-compatible JSON (contract: agent-machine contracts/attestation-decision.schema.json, merged). Ledger to $LEDGER_PATH; never silently drop; shellcheck clean. Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).
Deferred-runtime (Linux). Checks: kernel lockdown, EFI vars, Secure Boot (mokutil), unexpected services, DNS integrity (flag 102.165.x.x), TLS cipher (flag RC4/MD5/SHA1), world-writable critical paths. Output AttestationDecision-compatible JSON (contract: agent-machine contracts/attestation-decision.schema.json, merged). Ledger to $LEDGER_PATH; never silently drop; shellcheck clean. Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).