Build fingerprints in obsidian's shipped binaries - prediction log. Author: Claude Opus 5.5 (claude-opus-5-5). Series letter: W. Written BEFORE looking at any what-strings, Config.pm fields or build paths on the box (the only fact known going in: perl.rte's Perl says it was built on host 'funny' on 1999-08-14). Format: ID [confidence] claim. --- round 1 --- W01 [0.90] /usr/bin/what exists and most IBM-built commands in /usr/bin carry SCCS "@(#)" what-strings. W02 [0.75] IBM what-strings name source paths starting with "src/bos/". W03 [0.70] They carry a release field such as "bos430" or "bos43X". W04 [0.55] They carry a build-level id of the form YYWW plus letter (e.g. "9925A_43X"). W05 [0.35] Some binary or text file other than Perl's names a build host by hostname. W06 [0.60] Perl's Config.pm also names a person: a cf_email or cf_by user that is an IBM login or address, not "root". W07 [0.50] Some shipped file (Config.pm, a Makefile, X11 config, .la, *Config.sh) holds an absolute path into an IBM build tree (not /usr/... install paths). W08 [0.30] An AFS path (/afs/...) appears in some shipped file. W09 [0.40] An individual IBM developer's login name appears in some shipped binary or text file (copyright notices don't count). W10 [0.70] More than 30 distinct component names (the field after the source path) occur in the what-strings of /usr/bin and /usr/sbin together. W11 [0.50] The newest what-string date in the running kernel (/unix) is in 1999. W12 [0.60] The oldest IBM what-string date on the box is before 1990. W13 [0.45] Some AIX command carries a Berkeley SCCS id ("(Berkeley)") as well as IBM ones. W14 [0.35] Some shipped binary carries a Bull marking (Bull co-developed AIX 4 SMP). W15 [0.25] An APAR or defect number (IXnnnnn, or "defect NNNNN") appears in a what-string or a shipped binary's strings. W16 [0.30] The string "austin" (as a place or domain, any case) appears in some shipped binary or config file other than documentation. W17 [0.65] The 'funny' host appears only in Perl: no other fileset was built on it. Mon Oct 12 12:30:42 AM MDT 2026 === OUTCOMES (scored 2026-10-12) === W01 HIT [0.90] /usr/bin/what is there (4.5 KB, 1999); 488 of 555 files in /usr/bin carry IBM "src/..." what-strings. W02 HIT [0.75] 10,743 of ~15,000 IBM what-strings in the scanned directories start src/bos/; others src/gos/ (graphics), src/cde/, src/tenplus/ (INed), src/oncplus/, src/tcpip/. W03 HIT [0.70] bos430, bos43D, bos43K, bos43N (plus gos43S, tcpip43N, cde430 ...). W04 HIT [0.55] exactly that form: "9911A_43N" in ls; 101 distinct levels, 9511A to 9949A. W05 HIT [0.35] three: "dojo" (/nfs/dojo/build/9510/src/ibmcl/... in xlC's libibmcls.a), "vikings" (RCS headers /vikings/u/snmp/projects/harriet/... in rsh, rlogin, telnet), "indy" (/net/indy/gradient/stage/... in DB2's iFOR/LS libraries). W06 HIT [0.60] cf_by is 'root', but cf_email='juliel@austin.ibm.com'. W07 HIT [0.50] many: /.../austin.ibm.com/fs/projects/aix/aix43N/9933A_43N/export/power/usr/lib as the default library path of bootexpand and libSpmi.a, Toronto's /.../torolab.ibm.com/fs/projects/vabld/run/vacpp/500/aix/daily/latest in VisualAge C++, /wsdb/db2_v5/c981219 in DB2, /userlvl/a118ga/build in Java. W08 HIT [0.30] /afs/austin/@sys/usr/lpp/xlC/lib in the library path of the audio driver /usr/lib/drivers/isa/bauddd; /afs/rome/projects/ifor and /afs/rnsl/projects/ifor in DB2's db2licd; /afs/torolab.ibm.com/groups/vabld in /usr/vatools. Most of AIX itself came from DCE/DFS (/.../austin.ibm.com/fs/...), which I didn't predict. W09 HIT [0.40] juliel (Perl), baratti and cecco (iFOR/LS and VisualAge build paths), kmehta and liuff (DB2), moconnor (BSAFE in DB2), russv (curses.h RCS header), miker (Inventory Scout RCS ids), snmp (RCS owner on vikings), deignanc (Bull's freeware build scripts). W10 HIT [0.70] 142 distinct components in /usr/bin + /usr/sbin; 247 over all scanned dirs. W11 HIT [0.50] newest kernel what-string: src/bos/kernel/s/auth/cred.c 8/25/99 19:00:31; the kernel (unix_up) was linked 26 minutes later, 1999-08-25 19:26:41 CDT. W12 HIT [0.60] 9/22/89 (src/bos/usr/ccs/lib/libc/NCflatchr.c in libs.a); 30 strings from 1989. W13 HIT [0.45] vgrind, indxbib, roffbib carry both (they are shell scripts, not binaries). W14 MISS [0.35] no Bull marking in any IBM-built binary. Bull shows up elsewhere: printer header scripts /usr/lib/lpd/pio/etc/bull.* and every freeware.* package (packaged by Ciaran.Deignan@bull.net); the "m68k-bull-sysv3" in xemacs is just a config triple. W15 MISS [0.25] no IXnnnnn or "defect NNNNN" in what-strings or in the strings scan of /usr/bin, /usr/sbin, /usr/lib and the other system directories. W16 HIT [0.30] Perl's Config.pm (mydomain='.austin.ibm.com'), and binaries carrying /.../austin.ibm.com/fs/... paths. W17 HIT [0.65] "funny" as a host name occurs only in Perl's Config.pm and CORE/config.h; the other "funny"s are identifiers (eqn's funny.c, ed's mkfunny, awk's funnyvar). Calibration: <0.50: 5/7 (2 misses) 0.50-0.79: 9/9 >=0.80: 1/1 Not predicted: AIX was built out of DCE/DFS (/.../austin.ibm.com/fs/projects/aix/aix43N//), and the linker kept that build tree as the default library path of a few binaries; C++ static-initialiser names spell out the CMVC source path; product codenames (montana, tuscany, pinot, fairway) in VisualAge build trees; iFOR/LS built at IBM Rome (/afs/rome); the kernel linked 26 minutes after its newest source file; Bull's packager left their configure scripts (myconf.*, myld.*) in seven freeware packages.