WIP: Preserve boot artifact and native entry contracts #3

Draft

erikinkinen wants to merge 6 commits from feature/posix-compat into main

pull from: feature/posix-compat

merge into: erix:main

erix:main

erix:feature/native-cli

erix:feature/phase-4-audit

erix:feature/dynlink

erix:feature/e2fs-fat

erix:feature/block-devices

erix:feature/centralized-process-authority

Conversation 0 Commits 6 Files changed 19 +2262 -31

erikinkinen commented 2026-09-12 18:08:39 +02:00

Owner

Copy link

Summary and rationale

Constrain the kernel handoff pointer and length to their ABI registers, preserving the independent jump target. The feature branch also retains explicit development/release artifact policy and exact Rust v0 runtime-namespace resolution needed by current dynamic kernel images.

Tracking and scope

Owning issues #1 and #2; runtime and transition defects #5 and #6. Existing artifact reproducibility and source-preparation evidence remains component evidence. Whole-image and guest-build acceptance remain separate gates.

Architecture, authority and failure behavior

Keep authenticated kernel exports, exact runtime namespaces, mapped stack and immutable handoff ownership. The correction changes compiler constraints and adds no fallback authority, mapping, argument or entry ABI. Explicit signing inputs and the separate fixture-key policy remain unchanged. Invalid runtime resolution still rejects before kernel entry.

Validation evidence

Original coherent realm source CI acceptance — 18 September 2026: Signed acc1e734f79366e965b7ab7cd41496afddc6b1fe passes CI 142 and CI 141. All four terminal logs are complete (144,166 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.

Original realm image UEFI prerequisite — 18 September 2026: Signed acc1e734f79366e965b7ab7cd41496afddc6b1fe adopts the original dynamic-link contract dependency. Four default/all-feature development/release Rust configurations, four UEFI builds with fatal linker warnings, strict host/UEFI Clippy, formatting and private rustdoc pass. All 53 Python fixture controls and the explicit signing authority checks pass. The emitted console debug EFI/PDB association and release artifact tree pass inspection with zero warnings. Direct implementation bytes are unchanged. Original CI must still accept both exact source-pair profiles and deliberate release diagnostics; coherent image and full guest-build acceptance remain separate requirements.

Command and boot dependency alignment — 15 September 2026

Signed d48450b6bbccc80cbae3cfcf2feece3e6b04a347 aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 41 default / 41 all-feature tests. All four host and UEFI configurations build successfully, including the supported make entry point. Signing-authority checks and 53 source/artifact/profile-owner fixture tests pass, as does private build-script documentation. The exact committed source-pair reproducibility, default/console EFI/PDB profiles and deliberate release-diagnostic checks pass in both component CI runs. Push/review CI 139/140 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending.

Signed Bootloader 3a99ba23cad27d7db4b87919425fc44d6e5db71b passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI 137 and 138 pass with four complete logs and zero warning candidates. Both final Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect.

Review checklist

• Signed revisions, strict host/UEFI checks and native ingress results recorded.
• Inline documentation, cohesive files and canonical governance preserved.
• Architecture and roadmap updated; the existing manual ABI remains valid.
• Complete remaining component audit, guest profiling and image gates.
• Merge or release approval; this review remains WIP.

## Summary and rationale Constrain the kernel handoff pointer and length to their ABI registers, preserving the independent jump target. The feature branch also retains explicit development/release artifact policy and exact Rust v0 runtime-namespace resolution needed by current dynamic kernel images. ## Tracking and scope Owning issues #1 and #2; runtime and transition defects #5 and #6. Existing artifact reproducibility and source-preparation evidence remains component evidence. Whole-image and guest-build acceptance remain separate gates. ## Architecture, authority and failure behavior Keep authenticated kernel exports, exact runtime namespaces, mapped stack and immutable handoff ownership. The correction changes compiler constraints and adds no fallback authority, mapping, argument or entry ABI. Explicit signing inputs and the separate fixture-key policy remain unchanged. Invalid runtime resolution still rejects before kernel entry. ## Validation evidence Original coherent realm source CI acceptance — 18 September 2026: Signed `acc1e734f79366e965b7ab7cd41496afddc6b1fe` passes [CI 142](https://git.erikinkinen.fi/erix/bootloader/actions/runs/142) and [CI 141](https://git.erikinkinen.fi/erix/bootloader/actions/runs/141). All four terminal logs are complete (144,166 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements. Original realm image UEFI prerequisite — 18 September 2026: Signed `acc1e734f79366e965b7ab7cd41496afddc6b1fe` adopts the original dynamic-link contract dependency. Four default/all-feature development/release Rust configurations, four UEFI builds with fatal linker warnings, strict host/UEFI Clippy, formatting and private rustdoc pass. All 53 Python fixture controls and the explicit signing authority checks pass. The emitted console debug EFI/PDB association and release artifact tree pass inspection with zero warnings. Direct implementation bytes are unchanged. Original CI must still accept both exact source-pair profiles and deliberate release diagnostics; coherent image and full guest-build acceptance remain separate requirements. ### Command and boot dependency alignment — 15 September 2026 Signed `d48450b6bbccc80cbae3cfcf2feece3e6b04a347` aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 41 default / 41 all-feature tests. All four host and UEFI configurations build successfully, including the supported make entry point. Signing-authority checks and 53 source/artifact/profile-owner fixture tests pass, as does private build-script documentation. The exact committed source-pair reproducibility, default/console EFI/PDB profiles and deliberate release-diagnostic checks pass in both component CI runs. Push/review CI 139/140 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Signed Bootloader `3a99ba23cad27d7db4b87919425fc44d6e5db71b` passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI [137](https://git.erikinkinen.fi/erix/bootloader/actions/runs/137) and [138](https://git.erikinkinen.fi/erix/bootloader/actions/runs/138) pass with four complete logs and zero warning candidates. Both final Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect. ## Review checklist - [x] Signed revisions, strict host/UEFI checks and native ingress results recorded. - [x] Inline documentation, cohesive files and canonical governance preserved. - [x] Architecture and roadmap updated; the existing manual ABI remains valid. - [ ] Complete remaining component audit, guest profiling and image gates. - [ ] Merge or release approval; this review remains WIP.

erikinkinen added 1 commit 2026-09-12 18:08:39 +02:00

fix: Make release EFI debug policy reproducible ... 1563a4d9a5

Select the UEFI bootloader linker policy from Cargo target and effective debug settings so release builds omit path-dependent PDB identities while development and deliberate diagnostics retain their matching symbols. Preserve existing optimization and runtime console choices.

Add original bounded artifact readers, ownership fixtures and fresh-directory profile checks to CI. Validate strict Rust checks, 35 Python cases and seven fresh artifact builds; retain earlier failures and separate full-image and VM acceptance.

erikinkinen added the

bug

ci

docs

phase-6

labels 2026-09-12 18:08:40 +02:00

erikinkinen referenced this pull request from erix/integration 2026-09-12 18:09:59 +02:00

[BUG] Packaged EFI debug identity varies across fresh build directories #28

erikinkinen referenced this pull request 2026-09-12 18:14:02 +02:00

[BUG] Fresh-profile CI cannot fetch its event commit from the shallow checkout #4

erikinkinen added 1 commit 2026-09-12 18:36:43 +02:00

ci: Fetch profile sources from the selected original repository ... 8cb4383699

Use the initial checkout repository URL and exact event commit for both fresh source trees so shallow CI history cannot prevent artifact validation. Preserve the pinned helper, original object checks, lock inputs and offline compiler environment without local-origin or branch fallback.

Add six tests of the actual workflow preparation body with local shallow and complete sources. All 41 artifact/source/owner tests and workflow checks pass; retain the original failed source route and validate the corrected public workflows next.

erikinkinen added 1 commit 2026-09-14 11:14:43 +02:00

fix: Resolve Rust v0 runtime namespaces in dynamic boot ... e7fa39357a

Recognize the defining runtime crate through length-delimited legacy names
and the documented v0 parent and implementation paths. Keep the exact C
memory entry points and core, alloc and compiler-builtins namespace ceiling;
foreign type arguments cannot authorize fallback lookup. Exact authenticated
kernel exports and declared object dependency scopes remain required.

Extract the predicate for five host regressions, including the observed
failed import and deep nesting without allocation or recursion. Strict host
and UEFI development/release checks pass with 34 units, seven standalone
cases and the Python fixtures. The prior image failure is retained; native
validation follows with the newly signed Bootloader selection.

Refs: #5

erikinkinen changed title from WIP: Make release EFI artifacts reproducible across build directories to WIP: Fix runtime symbol resolution and reproducible EFI artifacts 2026-09-14 11:28:50 +02:00

erikinkinen added the

security

label 2026-09-14 11:28:50 +02:00

erikinkinen referenced this pull request 2026-09-14 13:19:42 +02:00

[BUG] Kernel jump argument moves omit their register constraints #6

erikinkinen added 1 commit 2026-09-14 13:22:37 +02:00

fix: Constrain kernel handoff arguments to their ABI registers ... 3a99ba23ca

Bind the existing pointer and length directly to RDI and RSI. Remove
sequential unconstrained moves that can overwrite a later input or the
independent jump target. Preserve the mapped stack, exact handoff bytes,
entry address and interrupt/direction flag operations. Track issue 6 as
a source-constraint defect; no observed VM failure is attributed to it.

Warning-denied development/release default/all host and UEFI checks pass,
with 34 unit tests, seven standalone tests and all four Python fixture
suites. Private rustdoc and canonical Markdown checks pass. Matching native
ingress validation and current-head CI remain required after publication.

erikinkinen changed title from WIP: Fix runtime symbol resolution and reproducible EFI artifacts to WIP: Preserve boot artifact and native entry contracts 2026-09-14 13:41:07 +02:00

erikinkinen added 1 commit 2026-09-15 15:57:43 +02:00

build: Align dependencies for coherent runtime adoption ... d48450b6bb

Select the current original signed foundation commits in the existing Git
dependencies. Keep Rust implementation files unchanged and record the
separate product-image acceptance requirement in the roadmap.

The complete supported feature/profile matrix passes with formatting,
strict Clippy, unit tests, builds and private rustdoc. Product runtime
adoption remains pending the complete dependency graph.

erikinkinen referenced this pull request 2026-09-15 15:59:41 +02:00

[FEATURE] Enforce firmware-to-rootfs signatures and scoped signing of build outputs #1

erikinkinen added 1 commit 2026-09-18 08:10:13 +02:00

build: Adopt coherent realm contract dependencies ... acc1e734f7

Select original signed shared revisions so coordinated runtime images can
resolve one source identity for every dependency. Preserve the component
implementation and update the roadmap to keep consumer VM acceptance explicit.

Validate default and all-feature development/release tests, strict host/native
Clippy, freestanding builds, formatting and private-item rustdoc with warnings
denied. Full image and in-guest build acceptance remain separate requirements.

erikinkinen referenced this pull request from erix/integration 2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

All checks were successful

Hide checks

CI / markdown (pull_request) Successful in 15s

Details

CI / markdown (push) Successful in 16s

Details

CI / test (pull_request) Successful in 2m26s

Details

CI / test (push) Successful in 2m28s

Details

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/posix-compat:feature/posix-compat

git switch feature/posix-compat

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff feature/posix-compat

git switch feature/posix-compat

git rebase main

git switch main

git merge --ff-only feature/posix-compat

git switch feature/posix-compat

git rebase main

git switch main

git merge --no-ff feature/posix-compat

git switch main

git merge --squash feature/posix-compat

git switch main

git merge --ff-only feature/posix-compat

git switch main

git merge feature/posix-compat

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/bootloader!3

No description provided.