[FermiHart]

Summary

• add a constrained higher-half ELF64 UEFI loader with bounded ExitBootServices handling and an OVMF machine proof
• add UEFI TCG2 measurement collection, P-256 auth, durable rollback, authenticated v2 transport, and closed evidence bundles
• give all four ports current hosted gates and package experimental v2 surfaces in the C, host, and no_std Rust SDKs
• prepare SDK 1.4.0 metadata, site content, CI, and a draft-first signed release transaction with exact asset reconciliation

Safety boundaries

• BBP wire ABI remains frozen at 1.1; the frozen core files are unchanged
• v2, HMAC, P-256, and rollback surfaces remain experimental and offline
• no Secure Boot, physical TPM, TPM NV, physical board, or crates.io publication claim is made
• the constrained loader rejects NX requests and memory geometry beyond its 4 GiB direct-map contract before ExitBootServices

Testing

• make check
• make v2-portability v2-fuzz
• make tpm2-measure-test
• make freestanding CROSS=
• make ports-check CROSS=
• make ports-hosted-check
• make qemu
• make qemu-aarch64
• make qemu-riscv64
• make qemu-uefi
• make qemu-uefi-loader
• make qemu-uefi-tcg2
• clean-tree release packaging performed twice with byte-identical C and host archives
• cargo +stable package --frozen --manifest-path sdk/rust/bbp-wire/Cargo.toml

Release controls

• all five commits are SSH-signed by an allowlisted owner key
• signed annotated tag identity and commit are revalidated before draft creation and publication
• release assets are addressed through the numeric release ID, SHA-256 reconciled, and post-publication verified

Remaining limits

• GitHub publication waits for this PR to merge and for an independently signed sdk-v1.4.0 tag
• physical hardware evidence remains unproven and is rejected by default