test: record partial native bridge import control

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/fixture-before-harness-cleanup.json

@@ -0,0 +1,3 @@
+{
+  "remainingOwnedKeychainFiles": 0
+}

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/fixture-cleanup.json

@@ -0,0 +1,29 @@
+{
+  "allLaunchedChildrenConfirmedReaped": true,
+  "reapOutcomes": [
+    {
+      "processId": 65330,
+      "confirmedReaped": true,
+      "exitCode": 0
+    },
+    {
+      "processId": 65334,
+      "confirmedReaped": true,
+      "exitCode": 0
+    },
+    {
+      "processId": 65338,
+      "confirmedReaped": true,
+      "exitCode": 0
+    },
+    {
+      "processId": 65339,
+      "confirmedReaped": true,
+      "exitCode": 1
+    }
+  ],
+  "privateMaterialOverwrittenThenUnlinkedAfterChildReaping": true,
+  "physicalSecureErasureClaimed": false,
+  "status": "passed",
+  "ownedFixtureRootRemoved": true
+}

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/native-build.log

@@ -0,0 +1,37 @@
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:41:42: warning: 'SecKeychainGetTypeID' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+   41 |     if(!keychain||CFGetTypeID(keychain)!=SecKeychainGetTypeID())return errSecParam;
+      |                                          ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:270:10: note: 'SecKeychainGetTypeID' has been explicitly marked deprecated here
+  270 | CFTypeID SecKeychainGetTypeID(void)
+      |          ^
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:43:21: warning: 'SecKeychainGetPath' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+   43 |     OSStatus status=SecKeychainGetPath(keychain,&length,path);
+      |                     ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:474:10: note: 'SecKeychainGetPath' has been explicitly marked deprecated here
+  474 | OSStatus SecKeychainGetPath(SecKeychainRef __nullable keychain, UInt32 *ioPathLength, char *pathName)
+      |          ^
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:54:29: warning: 'SecKeychainCopyDefault' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+   54 |     OSStatus default_status=SecKeychainCopyDefault(&default_keychain);
+      |                             ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:384:10: note: 'SecKeychainCopyDefault' has been explicitly marked deprecated here
+  384 | OSStatus SecKeychainCopyDefault(SecKeychainRef * __nonnull CF_RETURNS_RETAINED keychain)
+      |          ^
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:58:28: warning: 'SecKeychainCopySearchList' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+   58 |     OSStatus search_status=SecKeychainCopySearchList(&search);
+      |                            ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:404:10: note: 'SecKeychainCopySearchList' has been explicitly marked deprecated here
+  404 | OSStatus SecKeychainCopySearchList(CFArrayRef * __nonnull CF_RETURNS_RETAINED searchList)
+      |          ^
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:145:42: warning: 'SecKeychainGetTypeID' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+  145 |     if(!keychain||CFGetTypeID(keychain)!=SecKeychainGetTypeID())return 0;
+      |                                          ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:270:10: note: 'SecKeychainGetTypeID' has been explicitly marked deprecated here
+  270 | CFTypeID SecKeychainGetTypeID(void)
+      |          ^
+<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c:166:47: warning: 'SecKeychainGetTypeID' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
+  166 |     int type_ok=!result||CFGetTypeID(result)==SecKeychainGetTypeID();
+      |                                               ^
+/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:270:10: note: 'SecKeychainGetTypeID' has been explicitly marked deprecated here
+  270 | CFTypeID SecKeychainGetTypeID(void)
+      |          ^
+6 warnings generated.

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/provenance.json

@@ -0,0 +1,59 @@
+{
+  "sourcesSha256": {
+    "NativeImportControl.c": "d3f8d3ed0a4e25098bc42c3bb8dca8650f2557ee8c180b61877814609ced73df",
+    "ImportSeed.cs": "feaac1c93bdb0f4e59bd0a9fb213d6de53cb89ece7393356c9d12d318b395c1b",
+    "native_import.py": "2a2e8b34d351e134e91df16569437893b9bf202966ee98267a81b0030a22111d",
+    "pure_apple.py": "1b2148f1c20578529355379ab94b439931d7241608a5d5effce8fc86f4af7bc6"
+  },
+  "nativeBridgeSha256": "0333994e217a3d111d36d7f31460eea69a286f9fc819e2d7c746df13d2aec46c",
+  "managedCryptographySha256": "f4957d7218a004a27bf8964e45147df6a88092c6e7344582082840d62c6c579a",
+  "sdkSeedSha256": {
+    "Opc.Ua.Client.dll": "620da406fabdbc75d11f9827ea7e39d2d3c762471bd2264b0d11f1d6cd9247cd",
+    "Opc.Ua.Configuration.dll": "6ed6a594c93c3ff35d1a16539a9fe87c1e2640549cc2f48ed6bae333dc8bf0e7",
+    "Opc.Ua.Core.Schema.dll": "51cfad48657d95d38074bb88be29aea6f5b361a07397247d58838d066b99772e",
+    "Opc.Ua.Core.Types.dll": "a7dd141b8dabe8848ff28c2fb8e16a85a0508e6a49e6b1a1c1e267175b99af96",
+    "Opc.Ua.Core.dll": "9d0857aa6b7f3c49037d4ea557b4da8edf07e146069464481783e66c5c9cd35a",
+    "Opc.Ua.Security.Certificates.dll": "7f4969aceb2f0db5328c6882cb4b117342f3b18905c38acdba600683860c4fd0",
+    "Opc.Ua.Server.dll": "930e714a2f6e15d393840bcdc95e1afa8012bc740c3738a655f958142721864e",
+    "Opc.Ua.Types.dll": "c542f69882f4e8a4ebd5ccc28a3881d6967c7ffb6dcc3c56dc6c776f39c2ede1"
+  },
+  "compileCommand": [
+    "clang",
+    "-std=c11",
+    "-O0",
+    "-g",
+    "-Wall",
+    "-Wextra",
+    "<user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-lifecycle-memory/native-retention/NativeImportControl.c",
+    "-framework",
+    "Security",
+    "-framework",
+    "CoreFoundation",
+    "-o",
+    "/private/tmp/opcua2-native-import-20261110a/NativeImportControl"
+  ],
+  "compiler": "Apple clang version 21.0.0 (clang-2100.0.123.102)\nTarget: arm64-apple-darwin25.5.0\nThread model: posix\nInstalledDir: /Library/Developer/CommandLineTools/usr/bin\n",
+  "os": "ProductName:\t\tmacOS\nProductVersion:\t\t26.5.2\nBuildVersion:\t\t25F84\n",
+  "architecture": "arm64",
+  "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  Not set\n\nglobal.json file:\n  <user-home>/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+  "repetitions": 200,
+  "stages": [
+    "before",
+    "first",
+    "repeated",
+    "idle"
+  ],
+  "idleSeconds": 5,
+  "fullSoakGate": false,
+  "managedCallerInMeasuredChild": false,
+  "managedPfxParsingEmulated": false,
+  "legacyKeyLifetime": "Explicit CFRelease after identity disposal; managed local has no explicit using scope.",
+  "wrapperNativeCopyCallsPerOperation": 9,
+  "checkpointDeadlineSeconds": 180,
+  "deadlineScope": "Checkpoint/child deadline; in-progress bounded probes and bounded reap add overhead.",
+  "defaultOrSearchListSetters": false,
+  "fixtureCreationUmask": "0077",
+  "binarySha256": "e5c5caf2a8f882f82b738396156b378fd157ebd1a825d462449cd2a0497830fd",
+  "seedBinarySha256": "1fa7de542aee11acab18dcc8d4096b21fcbc16e4edc1fca2243159dd1176adc0",
+  "linkedLibraries": "/private/tmp/opcua2-native-import-20261110a/NativeImportControl:\n\t/System/Library/Frameworks/Security.framework/Versions/A/Security (compatibility version 1.0.0, current version 61901.101.4)\n\t/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (compatibility version 150.0.0, current version 4424.1.255)\n\t/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0)\n"
+}

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/samples.jsonl

@@ -0,0 +1,4 @@
+{"kind":"fingerprint","stage":"before","defaultStatus":0,"defaultPathStatus":0,"searchStatus":0,"searchPathStatus":0,"defaultSha256":"08c2c77dd8eaf8042b4020991ea06c6215cc391532869bbf6ced2cf1126c5e63","searchSha256":"c05fae700986dc7a6a147a938ef2adc4a274173420e137929ed58ad986eb2a3c","searchCount":2,"ownedQueryReferencesReleased":2}
+{"kind":"checkpoint","mode":"native-bridge-import","stage":"before","operations":0,"processId":65339,"utc":"2026-11-10T22:25:23.068Z","elapsedSeconds":0.006057,"rssBytes":7815168,"createdRefs":0,"releasedRefs":0,"managedRuntimePresent":false}
+{"kind":"operation","iteration":1,"certReturn":1,"certStatus":0,"modernReturn":1,"modernErrorCode":0,"modernErrorPresent":false,"createStatus":0,"pathStatus":0,"neverLockStatus":0,"externalReturn":1,"externalErrorCode":0,"externalErrorPresent":false,"legacyReturn":1,"legacyStatus":0,"moveReturn":1,"moveStatus":0,"copyCertStatus":-2147483648,"deleteStatus":0,"privatePathVerified":true,"deleteDuringFinalIdentityUntrack":false,"fallbackCleanup":false,"logicalOwnersRemaining":0,"ownedOutputs":9,"releasedOutputs":9,"failed":true,"copies":[{"stage":"import-cert-track","status":0,"returnedRef":false,"privateAssociation":false},{"stage":"move-outer-copy","status":0,"returnedRef":false,"privateAssociation":false},{"stage":"move-cert-untrack","status":0,"returnedRef":false,"privateAssociation":false},{"stage":"move-cert-track","status":0,"returnedRef":true,"privateAssociation":true},{"stage":"move-identity-track","status":0,"returnedRef":false,"privateAssociation":false},{"stage":"release-original-cert","status":0,"returnedRef":true,"privateAssociation":true},{"stage":"release-identity","status":0,"returnedRef":false,"privateAssociation":false}]}
+{"kind":"failed","message":"Native bridge import operation failed after ownership cleanup","createdRefs":1,"releasedRefs":1,"elapsedSeconds":1.172310}

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/seed-build.log

@@ -0,0 +1,9 @@
+  Determining projects to restore...
+  Restored /private/tmp/opcua2-native-import-20261110a/ImportSeed.csproj (in 31 ms).
+  ImportSeed -> /private/tmp/opcua2-native-import-20261110a/bin/Release/net10.0/ImportSeed.dll
+
+Build succeeded.
+    0 Warning(s)
+    0 Error(s)
+
+Time Elapsed 00:00:01.25

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/seed.jsonl

@@ -0,0 +1 @@
+{"kind":"seed","leafSha256":"31a4b6181cc10f0bc862a83199688b35d3c5e2590a2c00ab4cae6c3b1dc3d179","runtime":"10.0.14","sdkVersion":"2.0.1.0","managerDisposed":true,"certificateCoresOutstanding":0,"keyFormat":"PKCS1-private-RSA","privateFileMode":"0600","cryptographyRuntime":{"informationalVersion":"10.0.14\u002B0427b9abbead3fa64c6655eb4290c537397131fa","sha256":"f4957d7218a004a27bf8964e45147df6a88092c6e7344582082840d62c6c579a"}}

scripts/validation/opcua-lifecycle-memory/native-retention/evidence/2026-11-10-native-import-attempt-a/verification.json

@@ -0,0 +1,45 @@
+{
+  "status": "failed-partial-control-model",
+  "projection": "Replace local user-home prefix only; raw receipts unchanged.",
+  "rawOutput": "/tmp/opcua2-native-import-20261110a",
+  "rawSha256": {
+    "samples.jsonl": "06ca824cf08e2c26e595a4e70091f2f5a953ac3022908966ae9ee99987c1043d",
+    "provenance.json": "ad87286e153b8235aa13f3a60e9bc973f9c8886a038e947ed11304361e236590",
+    "native-build.log": "2fd25e9c530541c224872a28cf03b7d720be28fdd0216946b533d6292aad1a75",
+    "seed-build.log": "bd5eb3fbfeb649aa12254fa52689a778c97364c832bee0b6968f0432da129022",
+    "seed.jsonl": "8b4d9cb09fc134ffed468d4a0acc12d317cb9a77c0f90569ef52e83577baf333",
+    "fixture-cleanup.json": "0d5c8fe16558d2a21406c88d62ed87690649d3deac7bd333d8741672a23f86c7",
+    "fixture-before-harness-cleanup.json": "eaaf36a5e7f7d1d3635e987d8f9a2600ce55f6482011ec9a7abf3e4dd759d9c4"
+  },
+  "selectedProjectionSha256": {
+    "samples.jsonl": "06ca824cf08e2c26e595a4e70091f2f5a953ac3022908966ae9ee99987c1043d",
+    "provenance.json": "c6f6453edfb0c0601099e6275303359abec52f7566a47961a640bd97d554cbe9",
+    "native-build.log": "05fac84aff441e7a6b5ce2c3ac1d68cc3705b85495c39dd339964168335c5316",
+    "seed-build.log": "bd5eb3fbfeb649aa12254fa52689a778c97364c832bee0b6968f0432da129022",
+    "seed.jsonl": "8b4d9cb09fc134ffed468d4a0acc12d317cb9a77c0f90569ef52e83577baf333",
+    "fixture-cleanup.json": "0d5c8fe16558d2a21406c88d62ed87690649d3deac7bd333d8741672a23f86c7",
+    "fixture-before-harness-cleanup.json": "eaaf36a5e7f7d1d3635e987d8f9a2600ce55f6482011ec9a7abf3e4dd759d9c4"
+  },
+  "rawLocalOnlySnapshotsSha256": {
+    "heap-before.txt": "de4896c196fcf96e58933716049772e523e268be932cef7f9a76cf270f71cd79",
+    "lsof-before.txt": "f12e1115e87c4110c2961cb61c0b28ea3395c2ae780a72b431d71d4bfdd2a965"
+  },
+  "retainedInstalledBinaryInspectionSha256": {
+    "opcua2-native-runtime-loader-decompiled.cs": "89434500d1723f419e83ff45fcb6e44e73b58847f4201265613587ad82a79424",
+    "opcua2-native-runtime-pkcs12key-decompiled.cs": "60af9993d62032adf6be178efd93eef0f9c1a7a1bb2e091938d7171ab12875e2",
+    "opcua2-native-runtime-pkcs12key-base-decompiled.cs": "cf1e412c9752822610e6e9c96341d2b83052e2e284edc3d1c0086e95893a39b0",
+    "opcua2-native-runtime-rsa-decompiled.cs": "a4d9bdc8c0d78dac63f19639fb1da319e209a0f4af324edefd0fac8bc4b3becc",
+    "opcua2-native-runtime-applepal-decompiled.cs": "94e7ead2224719e0102983e0a13c97a9c713018640d73a7153ffea6f732312bf",
+    "opcua2-native-runtime-appleinterop-decompiled.cs": "da9b4ad8bd114e5b58a82607b37fbc8bc71f79a3a56dead60c88e718d8758c92",
+    "opcua2-native-runtime-keychainitem-decompiled.cs": "5fb58039e59d4839198fd74ed98978eed0d57008322489fd08d70d6481dd4fd4",
+    "opcua2-native-runtime-keyhandle-decompiled.cs": "595f2cf7d1c71a13dbdd21379a0ab072ce7d629753ca01f59e57bf789bec223e",
+    "opcua2-native-runtime-keypair-decompiled.cs": "623cf239bd9f755c701ba50ceffd4043591538111ca72261af4cd59c97db61c9",
+    "opcua2-native-runtime-certhandle-decompiled.cs": "d53053dfee192fe336e6fae055199ddcf4340da805ed8744e5e52c66f685e453",
+    "opcua2-native-runtime-identityhandle-decompiled.cs": "80b94acf27a0fbe38efcdc30c86e003ee2abfea30a3da5e9d535e1373ce97069",
+    "opcua2-native-runtime-keychain-decompiled.cs": "96c2e996638ffdd17c35483aaece7fdbc499fd004ab549e2e128bf82a64b5dc2",
+    "opcua2-native-runtime-keychain-base-decompiled.cs": "6f2abdb5779646a9bfd589d8fc765cab2e0290edee8396b2c7b2e6a4470e2bb4",
+    "opcua2-native-runtime-x509contenttype-decompiled.cs": "bed5256e025ed5b85f04b4cce132fcd7279fb06b5dd377d25f4caf39a8682b60",
+    "opcua2-native-runtime-apple-disassembly.txt": "75af92a3b05e4076025d43389cb3e51d8f6c8547aa485a4b5984469af7f02935"
+  },
+  "noRepeatCompletionOrRetentionInference": true
+}