[jrcruciani]

Scope

Implements item 05 only. Adds the requested ADR, aether-apply build|test|switch, human-only aether-confirm, protected snapshot/staging/build/activation handling, and synchronized prompt/playbook/README/hardening/rescue guidance. No LICENSE changes, later work-order items or live-host timer experiments.

• Conservative static syntax and risk floors; --risk only raises the floor. R4/unsupported proposals print a bounded source diff without mutation. Kernel/initrd/hardware changes are build-only with manual boot/reboot handoff.
• Exact root-owned candidate snapshots, explicit configured host selection, isolated command environment and protected auto-importer. Activation runs the built closure in a detached scope, not a fresh evaluation of mutable source.
• R3 test auto-arms. A different human principal confirms after fresh SSH access; confirmation owns successful disarm and a single-use candidate/context-bound token. Commits happen only after successful final activation.
• Recovery cancels blocked activation without waiting on its apply lock, never evaluates a flake, and preserves an uncommitted failed candidate. The recovery gate requires safe running and boot-default paths plus a fresh repository build equal to the running system; it survives reboot without preserving approval.

This is a cooperative-agent guardrail, not a hostile-Nix sandbox. Trusted packages/modules can execute privileged behavior. Root/wheel, additive sudo grants or another privileged route defeat the restricted-account assumptions. SSH freshness is human attestation.

Executed evidence

Tested executable/test/config SHA: b30cb4406dbe293867c2a0bf0db209959c333cce

Successful Linux run: https://github.com/jrcruciani/aether/actions/runs/35635585546

All three jobs passed:

• 17 policy/identity/state tests and all 13 actual restricted-account NixOS VM scenarios: real ripgrep 15.1.0/fd 10.4.2 build and installation; R3 firewall test, separate-human SSH confirmation/disarm and exact-candidate switch/commit; sudo denials; unchanged R4 state; unexpected paths/links; kernel/hardware refusal; lower declared risk; foreign/edited approval; failed arming/disarming; blocked-worker cancellation; failed activation; a real failed profile update followed by recovery activation and gate refusal until repair; and a real reboot with token removal, mismatch refusal and successful cleanup/build equality.
• All eight existing deadman VM subtests.
• Real host-pinned options-index builds at the existing 25.05 and 25.11 pins.

The VM uses the exact fixture flake/importer/proposal bytes for preloaded closures and persistent writable store storage. Checks/builds/activations/sudo/systemd are real, not command mocks. This remains direct-boot VM evidence, not a bootloader or live-host test.

PR head: 7af6e28ba0c0c5ee49dc1958a1e8041bd0bc305a. Its only delta from the fully tested SHA is the requested single section-05 evidence paragraph in docs/CHANGELOG.md; exact equality outside that file was verified. Automatically triggered PR CI may run, but no duplicate manual VM rerun is required for this documentation-only delta.

Parent review/merge remains the handoff boundary; this PR has not been merged.