crashd

crashd is the crash reporting daemon for EriX.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX crash service daemon. Its purpose in EriX is to provide the crash service role through explicit IPC and startup authority.

Functionally, it implements the daemon runtime, state model, IPC handling, and validation tests. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• implement the crash service runtime and state model
• validate startup authority before accepting IPC requests
• handle bounded service operations through the assigned endpoint set
• keep service behavior, tests, and authority invariants documented

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Build

cargo build --release

Test

cargo test

Features

• crashd-integration-smoke
• crashd-integration-force-fail
• crashd-integration-crash-reporting

Dynamic Boot Artifact Evidence

The image build packages crashd as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd through procd staged dynamic creation before dynlinkd; authority remains its read receiver and procd-only report receiver. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service-discovery, provider-bypass, block-device, clock, logging, or dynlinkd authority.

crashd neither self-registers nor receives service-directory or optional peer authority. Rootd publishes its endpoint only after observing successful startup. Report timestamps are deterministic per-service sequence values, so report acceptance requires no clock-service call or materialized peer.

Accepted crash reports are retained directly in a packaging-authenticated, deployment-sized ring and are read back through the explicit READ IPC contract. The service receives no allocator authority, and page padding is not available for unrelated state. Report acceptance does not perform logd IPC, so a busy or absent logging service cannot leave pending report-time authority behind or prevent later crash-report readback.

Required startup intake blocks without a service-local deadline. Runtime requests use the canonical IPC transport capacity, retire and reject any unwanted capability receipt, and retain their reply buffer through transient kernel backpressure. If receipt cleanup or terminal reply state is uncertain, the service fails stopped so process teardown removes otherwise unreachable authority.

Governance Principles

crashd governance is scoped to bounded crash-report collection and retrieval.

The scoped governance rules are:

• It accepts crash reports only through the procd-held report endpoint.
• It accepts diagnostic reads only through the separate read endpoint.
• It stores reports in explicitly deployment-sized state and preserves monotonic identifiers for diagnostics.
• It treats crash-report readback as the authoritative diagnostic surface for accepted reports.
• It rejects malformed or wrong-kind process events.
• It does not receive authority to restart, inspect, or control crashed processes.

Authority Boundaries

• The published service endpoint is read-only.
• Only procd receives a client for the distinct report endpoint.
• Request bodies cannot claim a reporter identity or change endpoint policy.
• crashd receives no naming, logging, clock, filesystem, device, or allocator authority; deployment sizing changes storage extent, not runtime authority.
• New authority must be represented in bootstrap/capability validation and integration tests before use.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.