What

Removes capability that should never have shipped, and adds a release gate that proves it stays removed. Driven by a private static audit of the rc.1 artifacts after Microsoft's ML flagged them.

The framing matters, because it sets what this PR can and cannot claim. The same sha256 (9e2f0f12…, linux-amd64) went from 0/62 clean to Microsoft-detected in about an hour with no byte change — our own run-134 log versus a later rescan of the identical file. So part of that verdict lives in scanner-side state, and no code change can promise a clean scan. What code can do is stop shipping malware-shaped surface that has no business in a release artifact. Every item below stands on its own security merit; a wider classifier margin is a side effect, not the justification.

The findings

Executable stack on every Linux binary we have ever shipped. vendored/nomic/code_vectors_blob.S is the only assembly in the build and carried no .note.GNU-stack. An unannotated object makes ld assume the worst for the whole link, so every release had GNU_STACK RWE. Fixed at the cause (the note) and the outcome (ELF-only -Wl,-z,noexecstack). Verified on a real Linux ELF: RWE → RW.

A test probe that forks a SIGTERM-ignoring immortal child and writes its pid to a caller-supplied path shipped in production (src/main.c). Test seams are now opt-in (TEST_SEAMS=1 → CBM_ENABLE_TEST_SEAMS); disabled builds compile a trivial success stub so call sites are untouched and the binary holds no fork, no signal handler and no env-var string. Opt-in deliberately: forgetting the flag now yields a clean binary rather than a leaky one.

The daemon spawned curl against the GitHub releases API on the first eligible session of every run, to say "a newer version exists". That put a release URL and an outbound request in every shipped binary. Deleted. The injectable seam survives — update_ops is still honoured and the fakes in tests/test_daemon_application.c still cover notice / ownership / cancellation / generation-replay — and with no provider application_update_subscribe_locked returns early, so no generation ever starts. "No network request by default" is now structural, not a promise.

Dead capability. The tar.gz/zip extraction block (verified self-contained, zero uses of any helper outside it, only callers the already-excluded updater and tests/test_cli.c) moves under CBM_CLI_ENABLE_TEST_API. Download → decompress → pick an executable → mark it executable is the canonical dropper composite; it is now absent, not merely unreachable. SQLite is built -DSQLITE_OMIT_LOAD_EXTENSION (no caller anywhere in src/ or internal/).

Temp files and env scanning. Predictable /tmp/cbm_search_<pid>.pat-style paths opened with plain fopen → private cbm_mkdtemp directory + cbm_mkstemp exclusive creation, written through the returned descriptor and never reopened by name. pass_envscan.c no longer descends symlinked directories out of the project root (lstat on POSIX, reparse-point screening on Windows where lstat does not exist), and its fixed 512-byte buffers no longer truncate into pointer arithmetic that could land outside the buffer.

Build-time entropy. mimalloc's banner baked __DATE__/__TIME__ into every binary, so two builds of identical source seconds apart could never share a hash — and no release could ever inherit a false-positive determination made about its predecessor. Local patch removes it (marked to survive refreshes), -Wdate-time makes any future use a build error, -Wl,--no-insert-timestamp stops the PE header carrying the link clock.

The gate

scripts/ci/check-binary-composition.sh, wired into package-release.sh after strip (the last byte-changing step) so the local artifact-flow smoke enforces exactly what the release does. Asserts absences — test seams, updater URLs, SQLite load-extension, UI/HTTP in standard artifacts, non-executable stack — plus a canary string, because an absence check aimed at a compressed, stubbed or empty file would otherwise pass vacuously and read green. A missing tool is a hard error: a skipped assertion must never look like a satisfied one.

It earned its keep immediately. Both SQLITE_OMIT_LOAD_EXTENSION and the mimalloc patch silently compiled to nothing on the first rebuild, because prod_sqlite3.o / prod_mimalloc.o depended on a single named source and make never recompiled them. Source review would have called both "done" — this is very likely why earlier fixes in this saga appeared to work for one release and then stopped. Now fixed: those objects depend on Makefile.cbm (and mimalloc, an amalgamation, on its included sources), plus a .build-config stamp that removes the binary on any config change so the guarantee does not rest on mtime granularity.

Deliberately NOT done

• Three seams stay in release artifacts: CBM_TEST_CRASH_ON, CBM_TEST_HANG_ON, CBM_TEST_WINDOWS_USER_PATH_RUN_ID. scripts/smoke-test.sh runs against the real release artifact and needs them — the run-id is what stops the PATH smoke writing the tester's actual PATH. Removing them would trade genuine release-artifact coverage for a cosmetic win. The gate treats them as an allowlist, so a novel seam still fails.
• No-UI standard build deferred. src/ui/* is in PROD_SRCS and four files outside src/ui reference UI symbols (src/main.c, src/daemon/host.c, src/daemon/application.c, src/mcp/index_supervisor.c), including the daemon that serves the UI. That assertion reports INFO until the split lands (CBM_CHECK_UI_ABSENT=1 enforces): a gate everyone knows is red teaches people to ignore gates. All six UI needles were verified unique to src/ui/ so it will bite correctly when enabled.
• No grammar removed. ObjectScript is ~100% of the binary growth since the last provably-clean release (+21.4MB rodata, +1.1MB text from two four-line shims), which made it the obvious ablation candidate — but a dry run performed twelve real Defender endpoint scans across standard/UI × amd64/arm64 with ObjectScript, the daemon and the expanded hooks all present, and every scan was clean. Nothing there is a deterministic trigger, so cutting a community-contributed language would spend a real feature on unproven margin. Lean is not a candidate either: at 99.6MB of source it is by far the largest grammar, but it shipped in v0.9.0 which scanned 20/20 clean, so removing it would produce a novel unscanned profile instead of restoring a known-good one.

Also in this PR

README.md was actively wrong, not merely incomplete: it documented in-place updates for macOS/Linux and promised "The MCP server also checks for updates on startup and notifies on the first tool call" — a claim that died with the MCP update thread and then the daemon's curl check. Rewritten to state the one contract that holds everywhere, why it works that way, and the affirmative property that replaced it. uninstall now reports the install script beside the binary (path + rm command, "would leave" under --dry-run) but does not delete it: that file may be the user's own copy, a symlink into a checkout, or package-manager managed, and an uninstaller must not delete what it cannot prove it owns.

Verification

• macOS C suite: 5166 passed, 0 failed, 0 skipped.
• Linux: build + composition gate green, 13/13 assertions on an unstripped ELF (stronger than a stripped one for the symbol-absence checks), RWE → RW confirmed against the flagged artifact.
• Windows (real ARM64 VM): 726 passed, 0 real failures; all guards green including test_windows_update_handoff.py ("update handed off to install.ps1 without touching its own image"). One reported failure was an invalid suite name in my own runner script, re-run clean with names verified against --list-suites.
• Full local contract set green, including venue-parity over the edited workflow-adjacent scripts.
• New precondition in tests/test_worker_watchdog.sh: it asserts the seam is present and says how to get it, instead of dying later with an opaque Killed: 9.

Risk

Behaviour-preserving by construction for the removals (dead or test-only code). The two real behaviour changes are the daemon no longer performing a background version check (intended, documented) and uninstall printing one extra section. The gate is release-blocking, which is the point — but it fails closed on a missing tool or an unreadable file, so a broken toolchain surfaces as a red gate rather than a silent pass.