# Independent Provenance Review: Xeno PTY Runtime

## Review identity

- Component: Xeno-owned native PTY runtime
- Replacement milestone: PROPRIETARY-PTY-1
- Implementation record path: `ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md`
- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
- Reviewer: pending
- Domain reviewer (required): pending native/runtime security reviewer
- Review date (UTC): pending
- Reviewer independent of implementation: pending

## Evidence checks

- [ ] Behavioral contract predates or is independent from implementation work.
- [ ] Normative and public sources are listed with revisions and evidence paths.
- [ ] Contributor source-exposure disclosures are complete.
- [ ] Required separation/counsel decisions are attached.
- [ ] No copied source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
- [ ] AI inputs and human review satisfy the contributor guide.
- [ ] Intentional incompatibilities are approved and versioned.
- [ ] Conformance, malformed-input, security, resource-limit, and fuzz evidence meets the component gate.
- [ ] Bundle graph, native hashes, SBOM, ownership inventory, and clean-install graph agree.
- [ ] Licenses, patents, trademarks, and specification terms have an explicit disposition.

## Similarity and provenance review method

- Files and revisions reviewed: pending
- Comparison method and tools: pending
- Findings: pending
- False positives and disposition: pending

## Verification summary

| Gate | Evidence | Result | Notes |
| --- | --- | --- | --- |
| Windows contract compatibility | focused PTY unit/integration suite | engineering pass | 13 tests, independent rerun pending |
| Security/resource limits | bounded queue/buffer, hash and manifest rejection, Job Object tree cleanup, Linux ASan/UBSan campaign | engineering pass | independent native security review and coverage-guided fuzzing pending |
| Lifecycle/soak | 25 integration cycles plus 100 Windows, 100 Linux, and 250 sanitized Linux stress iterations; active native state returns to zero | engineering pass | longer soak and platform handle tooling pending |
| Performance envelope | dependency-free startup/throughput benchmark | engineering pass | Windows p95 42.08 ms / ~8.7 MB/s; Linux p95 17.55 ms / ~32.6 MB/s; product approval pending |
| Cross-platform | Windows x64 and Linux x64 | partial | 12 Linux tests pass with one Windows-only assertion skipped; Windows/Linux ARM64 and macOS matrix evidence pending |
| Artifact ownership | ownership audit and dry-run tarball | partial | unsigned development binary; signed clean install pending |

## Decision

- Engineering provenance decision: needs-work
- Capability gate may be marked achieved: no
- Public clean-room/proprietary claim approved by this review: no
- Required follow-up: produce and observe the remaining claimed-architecture prebuilds, sign with an approved release key, run native fuzz/sanitizer and performance campaigns, collect contributor disclosures, assign independent reviewers, and attach counsel disposition.
- Reviewer signature/date: pending
- Counsel approval reference (required for public claim): pending