# Linux Crash RCA Preflight

`linux-crash-rca/1.0.0` implements the `linux-crash-rca/v1` BundleSpec as a
local-only inventory and preflight collector. It reads operator-selected files,
copies them into a review directory, computes exact SHA-256 digests, parses only
bounded ELF headers/notes, and emits a conservative capability matrix.

It has no upload, HTTP, cloud, Kubernetes, shell-command, artifact-execution, or
reproducer-execution code. Upload is always a separate operator action.

## Core types are not interchangeable

- `kernel_vmcore` must be an ELF core containing a bounded `VMCOREINFO` note,
  an exact kernel release, architecture, endianness, and build ID.
- `user_core` must be an ELF core without `VMCOREINFO`; it identifies the exact
  user executable build instead of claiming kernel-memory analysis support.

The preflight rejects malformed or ambiguous core headers. It never relabels a
user core as a vmcore, or the reverse.

## Review before consent

Start with a true dry run. It validates only the closed inventory descriptor and
does not read evidence, create output, contact a service, or upload anything:

```bash
./run-collector.sh \
  --inventory ./example-inventory.json \
  --source-root ./local-crash-case \
  --output ./linux-crash-review \
  --dry-run
```

Build an unconsented local review bundle next:

```bash
./run-collector.sh \
  --inventory ./case-inventory.json \
  --source-root ./local-crash-case \
  --output ./linux-crash-review
```

Inspect these files before deciding whether to share evidence:

- `reports/preflight.json`: missing/mismatched evidence and sensitivity flags
- `reports/capabilities.json`: stable capability states, reasons, evidence IDs,
  and remediation
- `manifest.json` and `checksums.sha256`: relative, classified, bounded files
- `redaction/coverage.json`: raw/redacted/omitted/not-collected coverage
- `bundle.json`: provenance, consent, retention, signature, and manual-only policy

An unconsented bundle sets `upload_safe_after_review=false` and will be rejected
by the worker with `consent_required`. After inspection, generate a fresh bundle
with explicit private-analysis consent:

```bash
./run-collector.sh \
  --inventory ./case-inventory.json \
  --source-root ./local-crash-case \
  --output ./linux-crash-consented \
  --consent-scope private-analysis \
  --retention-days 30
```

Use `private-analysis-and-live-reproduction` only when reviewed reproduction
inputs are intentionally included. The collector and worker still never execute
those inputs; the scope only records evidence sufficiency for a separately
authorized isolated workflow.

## Sensitivity

Core memory is always classified `secret`, with possible PII and secrets
declared. Logs, container context, and reproduction inputs are also treated as
possibly secret; symbols, source maps, and platform/hardware inventory are at
least restricted because they can contain user or source paths. Text evidence
is additionally scanned for bounded pattern categories; matching values are
never copied into reports or validation messages. Underdeclared secret/PII content fails with
`sensitive_input_undisclosed`.

Detached bundle signatures are optional in v1 and closed-declared. This public
preview emits `unsigned`; release integrity is provided by the published
`SHA256SUMS`. See `bundle-spec.yaml`, `schemas/`, and
`docs/collectors/linux-crash-rca-v1.md` in the source repository.