# Phase 1.0BI: real facade and exact host-tool installation audit

Status: `REAL_FACADE_SOURCE_AND_EXACT_TOOL_INSTALL_ALLOWED_NO_BUILD`

Date: 2026-07-29

The bounded facade may use Linux `Popen` only with `shell=False`, a new process
session, nonblocking merged output, selectors, monotonic time, a per-request
byte cap and process-group termination on timeout/overflow. It may expose only
the eight BG requests and read-only output-existence checks. There is no CLI,
retry, cleanup, package manager, RetroArch operation, network or device path.

The WSL environment is x86_64 with Python 3.14.4 and noninteractive sudo.
Official Ubuntu resolute metadata binds CMake `4.2.3-2ubuntu2` package SHA-256
`87c496...becc61` and ninja-build `1.13.2-1` package SHA-256
`533239...8f156`. Installation of only those exact versions is allowed and
must be verified from dpkg and executable hashes afterward.

This phase authorizes dormant real-facade source and the exact two-package host
installation. It does not authorize invoking the materializer, compiling SDL
or RetroArch, producing an artifact or acting on a PS5.