[FEATURE] Audit authority, code quality and documentation in bootloader #2

New issue

Open

opened 2026-09-12 07:57:25 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:57:25 +02:00

Owner

Problem and motivation

This issue tracks continuous Phase 6 audit closure for bootloader. Verify boot-critical payloads and construct the initial kernel handoff at the firmware trust boundary.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Current inventory: 1 Cargo target (1 bin); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Validation checkpoint — 14 September 2026: Signed Bootloader 3a99ba23cad27d7db4b87919425fc44d6e5db71b passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI 137 and 138 pass with four complete logs and zero warning candidates. Both final Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect.

Tracking and rollout

The correction is signed as e7fa39357a38c21529cccfd16cf3446eb07e8aa5. The actual namespace predicate now follows the defining crate in legacy and Rust v0 names, preserving the four exact C memory names and the core/alloc/compiler-builtins boundary. Foreign definitions cannot gain access by mentioning a permitted type later in the name. Prefix recognition uses checked lengths and iterative traversal; the unchanged loader still requires an exact authenticated kernel export.

The original predicate fails against an observed v0 import. Five new classifier regressions pass, including observed names, namespace refusal, malformed prefixes and 4,096 nested path components. All strict development/release default/all-feature host and UEFI checks pass locally: 34 unit and seven standalone tests per selection, plus the 12/22/13/6 Python suites. Formatting, private/build-script rustdoc and canonical documents pass with no compiler or lint warnings.

Push CI 135 and PR CI 136 pass for that signed head. Four complete logs total 144,258 bytes without warning candidates. Both workflows complete the original source preparation, fresh profile comparisons and deliberate release diagnostic checks; raw CI EFI/PDB artifacts are not published for independent byte inspection.

A new signed-image VM using this Bootloader resolves imports, seals mappings and enters Kernel under the unchanged 60-second hard and 45-second silence limits. The loader defect is resolved. The overall lifetime scenario still fails its required serial markers; Kernel issue 9 tracks that separate diagnostic defect. No realm rollout or full guest build is established.

Parent work: erix/integration#2 and erix/docs#1.
Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
Baseline revision: 55f2e5295adcff8215269ff694aabb85a276f122; refresh component/dependency heads and their own CI evidence as implementation advances.
Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `bootloader`. Verify boot-critical payloads and construct the initial kernel handoff at the firmware trust boundary. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope Current inventory: 1 Cargo target (1 bin); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Validation checkpoint — 14 September 2026: Signed Bootloader `3a99ba23cad27d7db4b87919425fc44d6e5db71b` passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI [137](https://git.erikinkinen.fi/erix/bootloader/actions/runs/137) and [138](https://git.erikinkinen.fi/erix/bootloader/actions/runs/138) pass with four complete logs and zero warning candidates. Both final Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect. ## Tracking and rollout The correction is signed as `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`. The actual namespace predicate now follows the defining crate in legacy and Rust v0 names, preserving the four exact C memory names and the core/alloc/compiler-builtins boundary. Foreign definitions cannot gain access by mentioning a permitted type later in the name. Prefix recognition uses checked lengths and iterative traversal; the unchanged loader still requires an exact authenticated kernel export. The original predicate fails against an observed v0 import. Five new classifier regressions pass, including observed names, namespace refusal, malformed prefixes and 4,096 nested path components. All strict development/release default/all-feature host and UEFI checks pass locally: 34 unit and seven standalone tests per selection, plus the 12/22/13/6 Python suites. Formatting, private/build-script rustdoc and canonical documents pass with no compiler or lint warnings. [Push CI 135](https://git.erikinkinen.fi/erix/bootloader/actions/runs/135) and [PR CI 136](https://git.erikinkinen.fi/erix/bootloader/actions/runs/136) pass for that signed head. Four complete logs total 144,258 bytes without warning candidates. Both workflows complete the original source preparation, fresh profile comparisons and deliberate release diagnostic checks; raw CI EFI/PDB artifacts are not published for independent byte inspection. A new signed-image VM using this Bootloader resolves imports, seals mappings and enters Kernel under the unchanged 60-second hard and 45-second silence limits. The loader defect is resolved. The overall lifetime scenario still fails its required serial markers; [Kernel issue 9](https://git.erikinkinen.fi/erix/kernel/issues/9) tracks that separate diagnostic defect. No realm rollout or full guest build is established. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `55f2e5295adcff8215269ff694aabb85a276f122`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

erikinkinen added the

labels

2026-09-12 07:57:25 +02:00

erikinkinen referenced this issue from erix/integration

2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from ~~[FEATURE] [P02.R03] Audit authority, code quality and documentation in bootloader~~ to [FEATURE] Audit authority, code quality and documentation in bootloader

2026-09-12 08:02:10 +02:00

erikinkinen referenced this issue

2026-09-12 18:08:39 +02:00

WIP: Preserve boot artifact and native entry contracts #3

erikinkinen referenced this issue

2026-09-12 18:14:02 +02:00

[BUG] Fresh-profile CI cannot fetch its event commit from the shallow checkout #4

erikinkinen referenced this issue

2026-09-14 13:19:42 +02:00

[BUG] Kernel jump argument moves omit their register constraints #6

erikinkinen referenced this issue from erix/integration

2026-09-19 11:36:52 +02:00