qvm: recover connect admission prefix

docs/FINDINGS.md

@@ -1751,3 +1751,6 @@ RE-813–822 replaces the scoreboard decimal assumption with actual37914 executi
 
 
 **RE-917:** Rust matches270 original252643 parser/filter cases, retaining byte wrapping, permissive separators, colon/localhost rules, supplied scratch bytes, signed table-count behavior and mode inversion. Malformed positive counts reject. Table population, native network behavior and actual scratch provenance remain open. [Evidence](research/RUST_ADDRESS_FILTER.md).
+
+
+**RE-918:** 160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries. [Evidence](research/QVM_CONNECT_ADMISSION.md).

docs/PROVISIONAL_TODO.md

@@ -1791,3 +1791,6 @@ RE-916: 270 actual252643/36306 cases recover exact localhost bypass, byte-wrappi
 
 
 RE-917: Rust matches270 original252643 parser/filter cases, retaining byte wrapping, permissive separators, colon/localhost rules, supplied scratch bytes, signed table-count behavior and mode inversion. Malformed positive counts reject. Table population, native network behavior and actual scratch provenance remain open. Full runtime completion remains open. [Evidence](research/RUST_ADDRESS_FILTER.md).
+
+
+RE-918: 160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries. Full runtime completion remains open. [Evidence](research/QVM_CONNECT_ADMISSION.md).

docs/RESEARCH_LEDGER.md

@@ -2310,3 +2310,8 @@ Rust matches256 original36306 fixtures across alignment/case/NUL/high-byte domai
 ## 2026-10-28 — RE-917 Rust original address filter and scratch ownership
 
 Rust matches270 original252643 parser/filter cases, retaining byte wrapping, permissive separators, colon/localhost rules, supplied scratch bytes, signed table-count behavior and mode inversion. Malformed positive counts reject. Table population, native network behavior and actual scratch provenance remain open. Focused `cargo xtask test-group rust-address-filter` passes (9 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.
+
+
+## 2026-10-28 — RE-918 Original connect admission and password gates
+
+160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries. Focused `cargo xtask test-group qvm-connect-admission` passes (4 Python tests); selected reports regenerate twice deterministically, with storage, documentation links and whitespace guards. Full suite deferred to task ten. Original assets unchanged; source fixtures do not establish complete native/runtime parity.

docs/REVERSE_ENGINEERING_TODO.md

@@ -1828,3 +1828,6 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 
 
 - [x] RE-917 Rust original address filter and scratch ownership ([evidence](research/RUST_ADDRESS_FILTER.md)).
+
+
+- [x] RE-918 Original connect admission and password gates ([evidence](research/QVM_CONNECT_ADMISSION.md)).

docs/research/QVM_CONNECT_ADMISSION.md

@@ -0,0 +1,7 @@
+# Original connect admission and password gates
+
+RE-918. Reproduce with `python3 scripts/analyze_qvm_connect_admission.py`; focused validation: `cargo xtask test-group qvm-connect-admission`. [Machine report](qvm-connect-admission.json).
+
+160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries.
+
+Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.

docs/research/README.md

@@ -1363,3 +1363,6 @@ The extension collector adds five focused tests for native tail calls, command-r
 
 
 [RE-917: Rust original address filter and scratch ownership](RUST_ADDRESS_FILTER.md).
+
+
+[RE-918: Original connect admission and password gates](QVM_CONNECT_ADMISSION.md).

scripts/analyze_qvm_connect_admission.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+"""Execute the verified original QVM body; native effects are supplied or captured."""
+import itertools
+from pathlib import Path
+from qvm_research_support import source,constants
+from qvm_camera_world_support import B,run
+from qvm_exit_rules_support import POOL,CPOOL
+from analyze_qvm_acceleration import word,number
+from analyze_qvm import write_json
+
+def main():
+ q,raw,h,ins=source();rows=[]
+ from qvm_connect_policy_support import environment,filters,admission
+ from qvm_map_commands_support import put_string
+ profiles=[(b'1.2.3.4',b'secret'),(b'8.8.8.8:27960',b'secret'),(b'localhost',b'wrong'),(b'1.2',b'SECRET'),(b'1.2.3.4',None)]
+ for profile,bot,password,mode,matching in itertools.product(range(5),[0,1],[b'',b'none',b'NoNe',b'secret'],[0,1],[False,True]):
+  ip,pw=profiles[profile];info=b'\\IP\\'+ip+(b'\\PASSWORD\\'+pw if pw is not None else b'');table=[(0xffffffff,0x04030201)] if matching else [];scratch=0xaabbccdd if profile==3 else 0;m,b=environment(raw,h);filters(m,table,mode,scratch);put_string(m,b,34087240,password);m[CPOOL+6336*3+468]=0xaabbccdd;m,p,b=admission(ins,m,b,3,0,bot,info);p.update(input=dict(profile=profile,bot=bot,password=password.hex(),mode=mode,entries=table,scratch=scratch,ip=ip.hex(),provided=None if pw is None else pw.hex(),userinfo=info.hex()),ring=m[23712]&0xffffffff,connection=m[CPOOL+6336*3+468]&0xffffffff);rows.append(p)
+
+ write_json(Path('docs/research/qvm-connect-admission.json'),{'source':q['source'],'sha256':q['sha256'],'root':173979,'probes':rows,'limits':'160 actual173979 prefix cases execute userinfo70503, address252643, unsigned36306 and case-folded69386. Native userinfo is fetched first; nonzero bot flag bypasses address/password checks. Banned rejection precedes password lookup. Empty server password or case-insensitive none disables the final case-sensitive check. Rejections occur before client clear; exact messages, lookup order and selector carry are verified. Filter scratch, engine userinfo/password and native admission remain explicit boundaries.'})
+if __name__=='__main__':main()

scripts/qvm_connect_policy_support.py

@@ -22,3 +22,21 @@ def environment(raw,h):
 def filters(m,entries,mode,scratch):
  m.update({36275948:len(entries),34082796:mode,FILTER+24:scratch})
  for j,(mask,value) in enumerate(entries):m[36275952+12*j]=mask;m[36275956+12*j]=value
+
+AUTH=COMPARE+0x4000
+def admission_handlers(userinfo,steps,state):
+ from qvm_persistence_support import info_lookup
+ from qvm_camera_world_support import casecmp
+ def get(i,m,a,bs):steps.append('userinfo');data=userinfo.split(b'\0')[0][:a[16]-1];return m,0,{'engine_userinfo_supplied':True,'child_memory_bytes':{a[12]+j:v for j,v in enumerate((data+b'\0').ljust(a[16],b'\0'))}}
+ def lookup(i,m,a,bs):
+  steps.append(cstring(m,bs,a[12]).decode('ascii'));m,v,p,b=info_lookup(i,m,dict(bs),a);return m,v,{'actual_source_child':70503,'child_memory_bytes':{v+j:x for j,x in enumerate(cstring(m,b,v)+b'\0')}}
+ def filtered(i,m,a,bs):
+  steps.append('filter');m,v,p,b=address_filter(i,m,dict(bs),a);state.update(filter_result=v,parsed=None if cstring(m,b,a[8])==b'localhost' else m[FILTER+24]&0xffffffff);return m,v,{'actual_source_child':252643}
+ def insensitive(i,m,a,bs):
+  steps.append('none-compare');m,v,p,b=casecmp(i,m,a,dict(bs),base=COMPARE+0x6000);return m,v,{'actual_source_child':69386}
+ def sensitive(i,m,a,bs):
+  steps.append('password-compare');m,v,p,b=byte_compare(i,m,dict(bs),a);return m,v,{'actual_source_child':36306}
+ return {-21:get,70503:lookup,252643:filtered,69386:insensitive,36306:sensitive}
+
+def admission(ins,m,b,slot,first,bot,userinfo):
+ steps=[];state={};m,v,p,b=run(ins,m,173979,174081,1080,{8:slot,12:first,16:bot},b,admission_handlers(userinfo,steps,state),base=AUTH);p.update(steps=steps,filter=state,accepted=v is None,message=None if v is None else cstring(m,b,v).hex());return m,p,b

scripts/test_qvm_connect_admission.py

@@ -0,0 +1,22 @@
+import json,unittest
+from pathlib import Path
+class OriginalTests(unittest.TestCase):
+ def test_instruction_results(self):
+  rows=json.loads(Path('docs/research/qvm-connect-admission.json').read_text())['probes']
+  self.assertEqual(len(rows),160)
+  from qvm_address_oracle import parse
+  for p in rows:
+   a=p['input'];steps=['userinfo'];accepted=True;message=None;ring=0;filtered={}
+   if not a['bot']:
+    ring=1;steps+=['ip','filter'];value=parse(bytes.fromhex(a['ip']),a['scratch']);match=value is not None and any(value&mask==entry for mask,entry in a['entries']);reject=False if value is None else bool(a['mode']) if match else not a['mode'];filtered=dict(filter_result=int(reject),parsed=value)
+    if reject:accepted=False;message=b'Banned.'.hex()
+    else:
+     ring=0;steps+=['password'];password=bytes.fromhex(a['password'])
+     if password:
+      steps+=['none-compare']
+      if password.lower()!=b'none':
+       steps+=['password-compare'];provided=b'' if a['provided'] is None else bytes.fromhex(a['provided'])
+       if provided!=password:accepted=False;message=b'Invalid password'.hex()
+   self.assertEqual(p['accepted'],accepted);self.assertEqual(p['message'],message);self.assertEqual(p['steps'],steps);self.assertEqual(p['filter'],filtered);self.assertEqual(p['ring'],ring);self.assertEqual(p['connection'],0xaabbccdd)
+
+if __name__=='__main__':unittest.main()

xtask/checks.tsv

@@ -2942,3 +2942,8 @@ report	scripts/analyze_rust_address_filter.py	docs/research/rust-address-filter.
 edge	docs/research/rust-address-filter.json	scripts/test_rust_address_filter.py
 group	rust-address-filter	scripts/analyze_rust_address_filter.py
 edge	scripts/analyze_rust_address_filter.py	scripts/analyze_qvm_resumer_audit.py
+edge	scripts/qvm_address_oracle.py	scripts/test_qvm_connect_admission.py
+report	scripts/analyze_qvm_connect_admission.py	docs/research/qvm-connect-admission.json
+edge	docs/research/qvm-connect-admission.json	scripts/test_qvm_connect_admission.py
+group	qvm-connect-admission	scripts/analyze_qvm_connect_admission.py
+edge	scripts/analyze_qvm_connect_admission.py	scripts/analyze_qvm_resumer_audit.py