Operating CADR through the Xvfb computer-use harness

Evidence boundary

Two different kinds of evidence appear here:

• Source and artifact facts identify the maintained LM-3 restoration check-ins, load-band file, and harness mechanism inspected on 2026-07-17.
• Runtime observations report pixels and responses produced by one cold-booted System 303-0 session. They establish behavior for that artifact and emulator combination, not automatically for an original MIT installation or a different load band.

The post-hardening confirmation run used:

The System 303 Fossil check-in is a maintained restoration branch. Its modern Fossil date is not the date on which the historical Lisp software was written. The table pins the exact source and emulator context of this observation rather than merging restoration history with original-system history.

The generation-5 source snapshot supplies the following private-copy fingerprint. The hash at start equaled the copy-time hash in each case:

The current public System, site, and Chaos revisions at start were the same as those copy-time revisions. The current public umbrella checkout was d1250f90044f09b6c92014a9aef65f9574e1bcbf8a7163004e53cc6dbed0f2d6. The private machine files selected by the configuration were:

Private-session architecture

Each named session lives below the ignored build/cadr-computer-use/<session>/ tree. The arrangement is deliberately local and disposable:

1. The default state root carries a .cadr-computer-use-root ownership marker. Each session carries .cadr-computer-use-session, and each completed runtime carries .cadr-computer-use-runtime. Existing roots or sessions without the expected marker are not adopted. An existing runtime must have the recognized marker before it can be reused, replaced by --fresh, or removed with its session.
2. The harness prepares the public LM-3 checkout and a usable usim binary when they are absent. A repository-global preparation lock serializes bootstrap and rebuild work on these shared inputs even when callers select different state roots. The computer-use start path retains that lock until its private disk and source snapshot is complete. The direct public-disk launcher uses the same lock and retains it for the entire emulator run, preventing a private snapshot from racing a direct run against the writable shared base.
3. A new session receives a private copy of the System 303 disk plus private sys, usite, and chaos source trees. Copying requests filesystem reflinks when available and falls back to ordinary sparse copies. Fresh preparation occurs in a temporary directory under the session: the disk copy is checked against the public base checksum, source provenance and a runtime marker are written, and only then is the completed stage installed by a same-filesystem rename.
4. The writable filesystem mapping and emulated disk point at those session paths. The configuration also loads promh.mcr, promh.sym, and ucadr.sym from the private sys/ubin copy. The usim executable remains a shared public-checkout input, but its exact contents are hashed at session start. Immediately before launch, the supervisor reacquires the shared preparation lock, hashes the executable again, compares it with usim_sha256_at_start, and calls Popen while still holding the lock. A mismatch fails the start rather than executing a binary different from the one described by preparation provenance.
5. A detached supervisor starts a 1024 by 1100, 24-bit Xvfb server with TCP disabled. It creates a fresh MIT-MAGIC-COOKIE Xauthority file with mode 0600 inside the private runtime and passes that authority explicitly to the X clients. A second repository-global lock serializes display-number allocation across all state roots; the harness also checks the X socket and lock before selecting a display.
6. usim creates a fixed-size, unscaled 768 by 963 client window. Keyboard and mouse actions are sent to that identified window through XTEST after focusing it.
7. The supervisor owns both processes. A normal stop terminates usim first, allowing its configured state and final framebuffer files to be written, and removes Xvfb only afterward. The harness records whether the public base-disk checksum remained unchanged. If either process exceeds its shutdown timeout and requires a kill, the run is labeled forced-stopped, with forced_stop and state_may_be_incomplete true instead of implying a clean saved state.

A plain later start cold-boots the session's existing private disk and source copies. start --fresh replaces that private runtime with copies of the current public base and then cold-boots it. Neither mode writes through the public base disk. Named sessions allow separate experiments without silently sharing their writable disk or source state.

The session tree also contains process logs, saved machine state, a native PBM dump, screenshots, and JSON metadata. It can contain changed Lisp-machine files and must not be treated as a publishable artifact bundle. All of it remains ignored and untracked.

Current screenshot provenance

The screenshot command captures the exact usim client window rather than the larger Xvfb root screen. For each numbered PNG it writes a JSON sidecar containing:

• local timestamp, session name, and session generation;
• load-band name and the base and private-disk checksums at start;
• public_source_revisions_at_start, the then-current Fossil identities of the umbrella, System, usim, site, and Chaos public checkouts;
• private_source_snapshot, which records when the private sources were copied, their System, site, and Chaos revisions at copy time, and hashes of the three trees at copy time;
• hashes of the private source trees at this start and flags saying whether each tree changed since it was copied;
• the usim executable hash and individual hashes of the private promh.mcr, promh.sym, and ucadr.sym machine artifacts used by the configuration;
• toolchain_provenance: Python version and executable, manifest.scm hash, Guix channel description or collection error, and resolved paths for the X server, authentication, input, capture, copy, locking, build, and Guix commands;
• X display, window identifier, title, and observed geometry;
• PNG SHA-256 and a SHA-256 over normalized eight-bit RGB pixels.

The explicit public-at-start and private-at-copy records prevent a later checkout update from being mistaken for the sources actually copied into a long-lived private session. The tree and file hashes cover private changes and executable or machine artifacts that Fossil identities alone cannot identify. The harness tree hash covers sorted relative names, entry kinds, symlink targets, and regular-file content hashes, with each component length-prefixed before hashing. The pixel hash distinguishes displayed pixels from incidental PNG encoding changes.

Raw screenshot files and sidecars remain ignored session payloads. After a separate redistribution review, a selected public-system capture can be copied into docs/assets/mit-cadr-screenshots/; its catalog and article must retain the session, action sequence, dimensions, image and pixel hashes, and shutdown result. Four System 303 Zmacs captures from session eine-zwei-20260718 have now completed that review and are tracked in the curated screenshot catalog. Their inclusion is an asset- and use-specific fair-use determination for historical analysis, not an inference that the Fossil tree or load band has one blanket license. The restrictive LMI notice in the tree is scoped to the separate Tape subsystem and no Tape content appears in these four frames. Unreviewed pixels stay local.

The execution-time check is recorded separately in session state as usim_sha256_at_exec. Current screenshot sidecars include usim_sha256_at_start but not usim_sha256_at_exec; an execution-integrity claim must join the screenshot sidecar with the corresponding run.json rather than inventing a sidecar field.

format, timestamp, session, generation, display, window_id, window_title,
window_geometry, load_band, base_disk_sha256, session_disk_sha256_at_start,
source_revisions, path, width, height, png_sha256, pixel_sha256

Current-schema cold-boot observations

The following are direct observations of session smoke, generation 5, on 2026-07-17. The interactions used only harness keyboard or mouse commands after a fresh cold boot. Each sidecar contains the current hardened provenance fields described above.

These observations confirm that the current host F5 mapping and host button 3 path reached useful System 303 interactions under the recorded usim revision. They do not by themselves establish the legends or electrical behavior of a historical keyboard or mouse. Source analysis remains necessary for those historical claims.

usim_sha256_at_start = 707a77d23e28ea1c45ae0eb0145dc181fa7ba649b9defc30044d4f847ac2c5be
usim_sha256_at_exec  = 707a77d23e28ea1c45ae0eb0145dc181fa7ba649b9defc30044d4f847ac2c5be

Loading public source through the isolated FILE bridge

The private harness can load public LM-3 files without putting them on the emulated disk. Its local Chaos FILE service appears to the guest as LOCAL-BRIDGE, with the public System tree exported below directory tree. A 2026-07-18 Spacewar session established an important pathname detail: ordinary Lisp Machine pathname components are canonicalized to uppercase, while the bridged Unix checkout uses lowercase names. The reproducible route is therefore to supply raw components explicitly:

(load (fs:make-pathname
        :host "LOCAL-BRIDGE"
        :raw-directory '("tree" "io1")
        :raw-name "swar"
        :raw-type "lisp"))

(load (fs:make-pathname
        :host "LOCAL-BRIDGE"
        :raw-directory '("tree" "fonts")
        :raw-name "ship"
        :raw-type "qfasl"))

The first form loaded into package SPACEWAR; the second loaded the public SHIP font into FONTS. Using ordinary :directory, :name, and :type components instead produced uppercase Unix path components and missed the files. This is a local bridge interoperability rule, not evidence that historical Lisp Machine file servers required lowercase raw pathnames.

The first bridge access in a fresh System 303 session also enters the world's generic file-login dialogue. The local FILE implementation has a deliberate lispm compatibility identity that maps to the current isolated host account before the ordinary Unix-user password path. In session hacks-record-cadr-20260726, arbitrary label MUSEUM did not authenticate; LISPM plus a non-secret placeholder in the dialogue's loginname<space>password form did. No historical site credential is required or appropriate. Later loads can repeat the short Please log in banner while proceeding with the saved local identity. The museum harness must never place a real password in a scripted interaction or provenance record.

The successful session then called SPACEWAR:INIT synchronously from the Listener top level, entered the live game, captured the complete application window, and stopped cleanly. See the Spacewar dossier and its curated capture record for the source hashes, exact runtime identity, and observed behavior.

A later shared Doctor/QIX session loaded four public demo/ files by the same raw route, confirming that the method is not Spacewar-specific. See the DOCTOR dossier, the HACKS suite dossier, and their shared capture record.

Current limitations

usim: illop, asserting halted
PC=00023 (ILLOP)
IR=(POPJ ZERO MF-1)

Repeating an observation

For a museum-grade behavioral note:

1. Start a named session with --fresh when an unchanged base is important.
2. Record the status JSON before interaction.
3. Record every key, type, and mouse action in order.
4. Capture a labeled screenshot after the relevant response.
5. Retain the local JSON sidecar and emulator log until the claim is reviewed.
6. In the tracked article, record the portable artifact name, dimensions, hashes, public and private disk checksums, current public and private copy-time revisions, private source-tree hashes, usim and private machine-artifact hashes, toolchain provenance, and whether the statement is a runtime observation or a source-supported historical fact.
7. Stop the session and record its exit statuses, forced_stop, state_may_be_incomplete, and base-disk integrity result. Use --discard when its private payload is no longer needed.

Do not commit the session directory merely to publish a screenshot. A screenshot that is ever selected for public distribution needs a separate content-rights and provenance review; the default preservation workflow keeps it local. The four cataloged Zmacs captures are examples of selected images that passed both reviews, not permission to publish the rest of either session tree.

Sources and verification

• LM-3 sys Fossil repository, maintained System 303 check-in 4df393c68d7f083ce42d5c377039d26043cc18a9031ace28258dc97f4137eb91.
• LM-3 usim Fossil repository, emulator check-in 330d8248ec2e12af071e287920e681600f75df9ffd854aada5f8a64c9adad64d.
• Local smoke session metadata, screenshot sidecars, and emulator logs under ignored build/cadr-computer-use/smoke/, inspected 2026-07-17.
• Curated System 303 Zmacs screenshot catalog, including its content-specific rights determination and session provenance, verified 2026-07-18.

Last verified: 2026-07-18.