[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

New issue

Open

opened 2026-09-19 11:36:51 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-19 11:36:51 +02:00

Owner

Copy link

Problem and motivation

Phase 6 needs one public completion record spanning POSIX compatibility, authority confinement, the complete guest build pipeline and the supplementary interface, signing and documentation requirements. Individual implementation issues and PRs retain their detailed contracts and evidence; this issue tracks the complete outcome.

Proposed behavior and scope

An EriX machine must build the entire declared EriX product graph from source, including every authored component, native build helper, generated document, signed boot artifact and complete bootable disk image. Boot an image produced by that build and perform a second complete build inside it. Both generations require exact source/tool/image identities, empty product output trees, complete logs, reproducibility checks and matching runtime tests.

The extended-image compiler must be built from selected upstream Rust/LLVM sources for execution on EriX, with EriX libc/sysroot integration, Rust standard-library OS bindings, LLVM code-generation libraries and the required C/C++ runtime closure. The initial EriX-hosted toolchain may be cross-built on Linux, then must execute and pass functional and authority-negative tests inside EriX. A Linux binary or target specification alone is insufficient. The extended development image must also rebuild the selected upstream Rust/LLVM toolchain and runtime closure inside EriX using its supplied offline sources, recipes, dependencies and explicit bootstrap compiler. Require no unrecorded porting changes or host build assistance; validate the guest-built tools and use the rebuilt compiler for at least one complete EriX build. Cross-compilation alone is not native rebuild evidence. The booted OS, firmware and compiler execution substrate must be inventoried separately from rebuilt product outputs. No cached EriX product object, hidden host build step or host-side repair/assembly may fill a missing guest output. The host may record, verify, export and boot completed artifacts through explicit paths.

The checklist includes real serial/PS2 CLI testing; native boot/hash tools with Linux support; help and manual pages; custom-key UEFI Secure Boot and signed rootfs authority; protected CI download signing; non-authoritative unsigned preferences; keyboard layouts; independent consoles, framebuffer clearing, vttys, TUI/extop, mouse selection/paste and the optional boot logo.

Authority, security and reliability

Priority is security, then reliability, then performance. Every capability needs an explicit source, recipient, object, rights, delegation limit, lifetime and retirement rule. Names, paths, IDs, uid 0 and environment text cannot grant authority. Preserve exact caller/process/receiver generations, least-authority source/output/tmp/tool roots, independent cleanup obligations and fail-closed handling of uncertain retirement. Full source/effect/frame and existing VM admission gates remain mandatory.

Audit the entire maintained codebase continuously; remove ambient, residual and unwanted explicit authority, deprecated APIs, obsolete migration paths and redundant code. Keep authored code below 1,000 physical lines through thematic refactoring. Document public and private invariants inline with rustdoc and enforce missing_docs in every crate. Profile bounded real workloads before claiming or implementing performance improvements; never trade away security, correctness, durability or fairness for speed.

Work on feature/posix-compat, preserve user changes and signed history, and push reviewable signed commits regularly using the canonical tagged-header/blank-line/body format. Pin cross-repository dependencies and CI helpers to full original commit hashes. Keep shared governance/templates identical to meta; update README/ARCHITECTURE/ROADMAP in their canonical formats and relevant manual TeX/API references. Use canonical feature_request, bug_report and PR templates with phase-6 and applicable topic labels. Keep credentials, sensitive evidence and suspected vulnerability details in their authorized private channels.

Acceptance criteria

Completion: 3.48% weighted acceptance; 15 of 460 individual items accepted. Reconciled 21 September 2026. The unweighted fraction is 3.26%. These measures count completed deliverables, not effort or elapsed time. Partial implementation earns no whole-item credit. Each section contributes its fixed weight multiplied by its completed-item fraction; repository audit rows count individually. A rounded percentage never substitutes for the final build and regression gates. The native Rust/LLVM rebuild gate added on 19 September 2026 increases the denominator from 459 to 460. The toolchain section has no accepted items, so weighted acceptance remains 3.48%; no completion credit was added.

Checking an item requires its complete deliverable and evidence at the selected original revision. Failed, skipped, cancelled, incomplete, warning-bearing or predecessor-only checks cannot establish acceptance. Implementation needs meaningful positive, malformed-input, authority-negative, interruption and cleanup tests, strict local checks, actual bounded VM coverage where relevant, and original CI observation. Preserve failures and unknown causes. Both full builds inside EriX remain unproven.

Phase 5 handoff and remaining gates

Weight: 2%; accepted: 2/10. Owning issue · integration PR 12.

• Preserve the archived tracker and an evidence index for the exact source graphs, CI logs, main-image hashes, rejected experiments and all failed timing observations; distinguish historical results from current-head gates.

• Observe CI 1549 to terminal status, audit every job/log and full scenario/post-image count, and classify remaining failures without weakening markers, source identity, worker ownership or deadlines.

• Review the held 10d57e98 checkpoint and record its disposition: preserve its signed ancestry when creating feature/posix-compat; publish a coherent new-branch graph only after the predecessor evidence is retained. Do not drop the locally committed pin or silently substitute an older graph.

• Run the carried checkpoint's own exact-head full CI and a fresh repository-wide CI inventory; resolve any failures/warnings at their owners.

• Revalidate the prepared direct-chunk private-image recipe against the chosen Phase 6 base before reuse; bind all source revisions, environments, cache keys, executable PT_LOAD bytes and rootd path/capacity differences.

• Build/audit matching private dev/release images once admitted; retain original helper failures and the narrow proven locale-receipt handling. Do not reuse a predecessor's symbol addresses or compiled-object attribution.

• Collect one adjacent audited control and two complete candidate startup observations, with no concurrent local VM/compiler, using unchanged 120 s total / 15 s silence / 10 s command collection limits.

• Close the carried startup acceptance only after both candidate observations satisfy root-to-final-READY ≤5 s, largest service-ready gap ≤1 s, final-READY-to-full-editor-caret ≤1 s, and the exact four-command interval ≤2 s. Preserve the maintained oracle and command; never retry unchanged input to green.

• Record remaining bottlenecks as Integration profiler and measured optimization findings if Phase 5 handoff and remaining gates fails; validate each eventual fix with strict component checks and matching VMs.

• Update the carried acceptance report and component/manual status with actual results; retain all six old unchecked rows as covered by these items rather than counting duplicate validation prose as six independent gates.

Scope, repository and build inventory

Weight: 3%; accepted: 3/16. Owning issue · integration PR 12.

• Inventory all existing repositories, nested Cargo workspaces and crates, targets, profiles, feature combinations, scripts and maintained tests. Record repository paths, remotes, exact heads, dirty state and build ownership.

• Record/create feature/posix-compat before each repository's first edit; verify exact dependency pins and signed ancestry from the accepted base.

• Verify whether lib-posixabi, lib-cstd and posixd already exist remotely; create each missing required repository in Forgejo from meta before cloning.

• Scaffold those three components with explicit responsibility and authority boundaries, rustdoc, strict CI, tests and specialized canonical docs. Keep import recipes/profiler in Integration; do not invent extra daemons/repos without a concrete ownership need and recorded design review.

• Add new components to Integration's commit-pinned catalogs and immutable dependency policy; validate the exact transitive source graph.

• Freeze a machine-readable full-build output inventory: every maintained EriX crate/library/binary, kernel, EFI bootloader, native build tools, boot image, dynamic/launch metadata, four image profiles and release manifests.

• Inventory all canonical generators, documentation/manual outputs, checksums/compression/signing steps and their host executables. Include these in the in-EriX build closure; distinguish external test execution from building.

• Record the build-host versus emitted-target matrix: EriX-hosted tools and compatibility libraries for x86_64-unknown-erix, plus the existing bare-metal and UEFI targets needed to rebuild the OS. Do not rewrite native target ABIs merely to make imported tools run.

• Produce an API/workload matrix from the exact intended Rust/LLVM, Cargo, Python, Git, shell, image and documentation recipes; map every required call/ELF feature to an owner, implementation item and independent test.

• Define the POSIX specification edition/profile, C ABI/data model, locale baseline and optional extensions. Mark unsupported optional surfaces explicitly; never claim full POSIX certification from a selected build workload.

• Resolve/document the existing Phase 6 close-on-exec-by-default policy versus standard descriptor inheritance expectations. Preserve native authority ceilings; specify any compatibility deviation before implementation.

• Approve the architecture/threat model for posixd isolation, process mediation, TLS, fork snapshotting, signal delivery and build realms. Enumerate trusted components and keep POSIX policy out of the kernel/rootd.

• Fix per-scenario resource budgets and progress/deadline contracts from measured workloads; distinguish ABI/hardware bounds, authorized quotas and accidental hard-coded limitations.

• Define exact self-host success/failure criteria and evidence schema before implementation: source-only inputs, no host build delegation, two clean in-EriX builds, deterministic artifacts, boot result and authority-negative tests.

• Extend inventories with rootfs authority-bearing files/signatures, firmware trust enrollment, native build-tool targets, man/help coverage and console/input interfaces; assign each an owning public issue and acceptance test.

• Record v1.0.0-alpha.1 as the intended manually reviewed release baseline, coordinating platform/component version policy without premature version bumps, tags, PR readiness or release publication.

Whole-codebase authority and quality audit

Weight: 8%; accepted: 1/102. Owning issue · integration PR 12.

• Create an audit register keyed by stable finding ID, repository, file/symbol, category, severity, exact revision, invariant, reproduction, remediation owner, regression test, status and closure evidence.

• Inventory every startup/runtime capability: origin, receiving principal, object, operations, delegation ceiling, lifetime and all aliases. Include boot handoff, service registration, compatibility realms and tools.

• Find ambient authority from global selectors, default service discovery, cwd/PATH/env, numeric slots/PIDs, implicit devices, inherited routes, host filesystem fallbacks and cache metadata; replace it with explicit grants.

• Find residual authority after success, error, cancellation, interruption, timeout, restart, failed reply/transfer, fork, exec and teardown. Prove every alias is retired or its necessary retention is documented.

• Find unwanted explicit authority: oversized startup inventories, broad provider/admin endpoints, duplicate aliases, unnecessary read/write/exec rights and debug routes. Attenuate/remove it even when technically explicit.

• Audit generation reuse, replay, stale pending replies, confused deputy paths, endpoint impersonation and TOCTOU around path/object resolution. Test forged descriptive identity without the corresponding capability.

• Audit cleanup failure behavior: attempt independent retirements, preserve existing caller-specific error precedence, including cleanup uncertainty overriding the triggering error, and quarantine/terminate when required; never continue serving with an unaccounted grant.

• Audit unsafe code, FFI, wire parsing, range arithmetic, initialization, lifetimes, locks, interruption and publication order; give each unsafe block an exact safety argument and adversarial test where practical.

• Inventory redundant implementations, dead/fallback code, duplicated validators, obsolete wrappers and deprecated public/wire APIs with all callers.

• Migrate callers and remove deprecated APIs/compatibility shims in coordinated signed graphs; test rejection of retired versions without silent permissive fallback. Do not retain an obsolete API solely to avoid caller edits.

• Classify every hard-coded size/count/depth/time restriction as ABI, hardware, explicit resource policy or accidental implementation limit. Replace accidental limits with checked caller-sized storage or authorized allocation.

• Test above every removed old boundary and at exact allocation/ABI boundaries; preserve resource exhaustion errors, denial-of-service protection and mandatory bounded waits instead of interpreting “no arbitrary limits” as “unlimited resources”.

• Inventory all authored code files at/over 1,000 physical lines, including tests, scripts and generated-source templates. Refactor them into cohesive modules below 1,000 lines, preserving meaningful APIs and tests.

• Add a deterministic tracked-source size gate; exclude only genuine non-code data/external payload archives, not large authored tests or fixtures containing executable logic. Split generators and their generated code too.

• Audit production versus integration/dev-only feature gating and linked symbols. Move/delete remaining test orchestration/diagnostics from production rootd; carry every retained move/delete classification to closure.

• Re-measure rootd semantic surface using the maintained baseline tooling; compare same-toolchain code size, imports, unsafe blocks, accepted messages and authority inventory, not incomparable historical LoC estimates.

• Audit bootstrap service ownership and release/development authority parity; prevent new compatibility work from adding policy or routine test orchestration back into rootd. initd/bootd-style work stays Phase 7.3.

• Audit all performance findings through Integration profiler and measured optimization evidence before changing algorithms; deduplicate measured hot paths without caching successful access checks, broadening grants or leaving invalidatable state unowned.

• Audit build/CI scripts for secret exposure, mutable shared outputs, symlink escapes, unsafe deletion, unbounded subprocesses, silent warning suppression and accidental host dependencies.

• Repeat the entire audit on final heads, independently review all security closures, and require zero unresolved in-scope authority, deprecated API, undocumented-code and over-1k-code findings before Phase 6 acceptance.

• Inventory obsolete planning/migration documents, manifests, scripts, CI jobs, feature flags and migration-only tests, including dynlink migration checks and the superseded local planning archive. Preserve necessary evidence in historical artifacts/issues, then delete obsolete active files and references; retain current specifications and security assertions, not obsolete scaffolding.

• Remove superseded static executable intake from every public launch, loader, policy, configuration and test path now replaced by dynlink intake. Map each former useful assertion to maintained coverage, reject retired input, and preserve genuinely required mount/bootstrap mechanisms with explicit scope. Inspect real consumers: a shared segment type used by dynamic materialization or the EFI loader's pre-runtime boot contract is not removed by name alone.

• Audit symbols, filenames, flags, wire names and diagnostic tokens for milestone terminology; replace planning-based naming with semantic responsibility names and update all consumers/tests atomically. Allow useful historical comments/docs and real algorithmic concepts, not executable planning APIs hidden behind an exception.

• Review code navigation, naming, control flow, error paths, module cohesion and inline explanations with a contributor/auditor walkthrough; merge semantically similar files where useful while staying below 1,000 lines.

• Identify repeated behavior across repositories suitable for an authority-free shared library; document genuine common semantics, variation, dependencies and boundaries before extracting it. Do not abstract merely similar syntax or combine unrelated trust domains.

• For each justified extraction, create a new Forgejo repository from meta first, clone/branch it, implement documented/tested shared APIs, migrate callers, remove duplicates, and add catalog/CI/manual/man-page/audit/PR entries. Add explicit checklist rows for every resulting repository and use exact dependency commit pins without circular service/library dependencies.

• Complete the authority, lifecycle, quality and documentation audit for blockd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for boot-tool, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for bootloader, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for coreutils, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for crashd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for deviced, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for docs, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-acpi, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-i8042, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-ps2-keyboard, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-ps2-mouse, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-rtc-cmos, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-serial, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for drv-virtio-block, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for dynlinkd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for e2fsd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for exsh, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for extop, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for fatd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for fbcond, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for hotplugd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for inputd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for integration, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for irqd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for kernel, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for keyd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for launchd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-aes, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-block, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-bootimg, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-bootstrap, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-capabi, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-cli, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-console, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-constant-time, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-crc, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-deflate, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-device, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-driver, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-dynlink, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-ed25519, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-elf, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-fs-crypto, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-fs-name, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-handoff, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-input, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-interrupt, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-ipc, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-log, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-partition, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-service, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-sha2, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-stdio, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-time, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-tty, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-vfs, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for loaderd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for logd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for memd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for meta, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for named, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for pagerd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for powerboxd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for probed, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for procd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for ramfsd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for rootd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for seriald, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for sha2-tool, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for timed, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for ttyd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for vfsd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for vspaced, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-posixabi, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for lib-cstd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

• Complete the authority, lifecycle, quality and documentation audit for posixd, including required tests and original CI; justify non-applicability per dimension. Repository audit.

Rustdoc, missing_docs and documentation

Weight: 5%; accepted: 2/15. Owning issue · docs PR 4.

• Inventory every crate root and target, including binary-only, build-script, test/example and nested crates; identify existing missing_docs enforcement and every local allow/expect/doc-hidden escape.

• Document crate/module purpose, trust boundary, owned/borrowed state, lifecycle, authority and error contracts using //!//// rustdoc comments.

• Document every public item, field, variant, constant, associated item, macro and FFI export with semantics, units, ranges and failure behavior.

• Document private functions, structures, fields and non-obvious algorithms as well; explain concurrency, mutation order, cleanup, complexity and invariants. missing_docs alone is not a private-code completeness audit.

• Give unsafe APIs # Safety, and fallible/panicking APIs accurate # Errors/# Panics sections where applicable. Document each unsafe block's concrete invariant and why safe alternatives do not cover the operation.

• Enforce #![deny(missing_docs)] or an equally non-bypassable shared lint policy in every EriX-authored crate/target; reject weakening attributes. Do not use blanket allowances, dummy comments or doc-hidden to pass the gate.

• Add private-item documentation review/check coverage and run Rustdoc with --document-private-items; validate broken links and examples with RUSTDOCFLAGS="-D warnings" across supported target/feature profiles.

• Ensure CI actually checks missing_docs in default and alternate feature builds, not only one public-library configuration; add a negative fixture proving undocumented public API fails the shared policy check.

• Document non-Rust authored code inline in its language's supported comment format, including shell/Python tools and assembly boundary contracts. Do not pretend rustdoc parses unrelated languages.

• Update meta standards/templates and propagate necessary policy changes deliberately. Repair stale canonical GenAI policy links to docs/policies/generative-ai-contributions.md; keep attribution optional.

• Update README/ARCHITECTURE/ROADMAP and relevant manual chapters for each implemented ABI, realm, POSIX service, toolchain, profiler and build step; keep historical measurements separate from current guarantees.

• Regenerate API references, test examples, build the whole manual, check final warnings/overflow/links and visually inspect changed rendered pages. Record toolchain/source provenance for the generated documentation.

• Update canonical templates and every repository README to remove current-status/progress/checkpoint sections; put concise current state in ROADMAP/ARCHITECTURE and detailed historical evidence in linked issue/reports.

• Refactor long README/ARCHITECTURE/ROADMAP paragraphs and exhaustive lists into short summaries plus focused design/API/operator documents. Preserve canonical headings, discoverability and normative invariants; do not hide important authority limitations or move status into another README section.

• Keep help text, man pages, rustdoc, C headers, IPC specifications and technical manual consistent through shared semantic metadata where useful; validate coverage and examples, not merely that generated files exist.

Integration profiler and measured optimization

Weight: 5%; accepted: 2/19. Owning issue · integration PR 12.

• Inventory existing READY/command timers and private QMP/PC evidence; define which collectors are reusable, incomplete, obsolete or unsafe to retain.

• Specify a versioned profile format with source/image/config hashes, toolchain, hardware/QEMU/acceleration/CPU/memory/worker settings, time domain, capture interval, exact process generation and module identity.

• Define explicit capture authority, lifecycle and permitted fields; exclude key material, capability contents, consent input and arbitrary process memory. Diagnostics must not confer process control or namespace access.

• Add a bounded host collector with hard/silence limits, owned PID cleanup, interruption handling, raw-log preservation and true failure status.

• Implement exact image/ELF/PT_LOAD/source binding and symbolization; reject stale maps and ambiguous userspace addresses without process/module identity. Do not infer process ownership from an overlapping virtual address.

• Add authenticated, opt-in guest timing/counter hooks where host samples cannot attribute a cost; compile/runtime gate them appropriately and prove their absence from clean release images when disabled.

• Record boot service stages: image resolution/read, relocation, mapping/materialization, process start, startup delivery, initialization, publication, cleanup, final READY and full shell-caret display.

• Record command stages: Enter acceptance, parse/expand/resolve, authority request/decision, file reads, link/load, spawn/scheduling, first execution/output, output drain, exit/wait and fresh caret.

• Measure IPC count/bytes/waits, runnable versus blocked time, context switches, mapping scans/batches, page allocation/faults, VFS/provider fanout, block request size/LBA, cache hits/misses and TTY/framebuffer work.

• Bound buffers through explicit resource policy, report dropped records, clock discontinuities and partial captures; never label incomplete data a complete profile or fabricate a percentage of total CPU time.

• Implement reproducible reports: service timeline, command critical path, per-component counts, latency distributions and symbol/sample summaries. Separate wall time, CPU time, blocking time and sampling observations.

• Add deterministic parser/attribution/error fixtures, malformed/stale identity tests, dropped-record tests and collector cancellation/timeout tests.

• Add VM profiler tests that identify known synthetic CPU, wait and I/O workloads, reject cross-realm capture and verify all capture authority is retired. Compare profiled versus unprofiled overhead without subtracting it from acceptance measurements.

• Establish controlled cold/warm startup and build baselines with isolated repeats, explicit resource limits and confidence/variance reporting. Preserve the stricter carried Phase 5 handoff and remaining gates startup thresholds without moving endpoints.

• Rank evidenced bottlenecks by measured end-to-end impact; create individual Whole-codebase authority and quality audit findings with one causal hypothesis, owner and acceptance test.

• Optimize the highest-impact proven path, then reprofile and repeat: inspect loader/provider fanout, mapping/process startup, event waits, build dependency scheduling and terminal delivery according to evidence, not guesses.

• For each optimization, prove unchanged authorization, revocation, permissions, object identity, failure ordering, output semantics and fairness; retain strict tests and isolated same-configuration before/after measurements.

• Add reviewed startup/build throughput and resource regression budgets to CI, using dedicated uncontended performance jobs and calibrated full-build deadlines. Ordinary functional jobs still have forced stall limits.

• Remove superseded diagnostic hooks/helpers and document how to capture, interpret and reproduce profiles. Keep only evidence-backed tooling.

POSIX ABI

Weight: 3%; accepted: 1/9. Owning issue · lib-posixabi PR 3.

• Define x86_64 C ABI sizes, signedness, alignment, byte order, calling conventions, structure layouts and ABI version negotiation.

• Define errno values and a complete native-error mapping table, including missing authority, absence, unsupported operation, interruption, would-block, exhaustion, stale identity and partial I/O.

• Define fd/open-description, PID/process-generation, process-group, session, thread and realm identifiers as non-authoritative compatibility data.

• Define file/status/mode/credential/ACL, seek/offset, directory, time, signal/action/set, wait and resource-limit types/constants.

• Define IPC shapes with exact validation, request correlation, version/reserved-field rules and normalized capability transfer expectations; keep pure ABI parsing free of syscalls or service lookup.

• Define checked 64-bit file/time arithmetic, C pointer/length handling, integer conversion and deterministic overflow/error behavior.

• Provide reviewed C header declarations corresponding to Rust ABI definitions; test layout/constant agreement with independent C and Rust probes.

• Test malformed/old versions, unknown flags, invalid identifiers, overflow, nonzero reserved fields, extra capabilities and noncanonical errors.

• Publish documented ABI compatibility rules and pass strict crate, header, cross-target and exact-head CI gates before consumers depend on it.

POSIX service and realm lifecycle

Weight: 6%; accepted: 1/19. Owning issue · posixd PR 5.

• Specify per-realm/per-process ownership and isolation inside posixd; separate private native service routes from each client's narrow authenticated ingress and reject numeric-realm impersonation.

• Implement create/configure/seal/start/abort/retire realm states with generation-bound identities, validated resource ceilings and exact rollback.

• Bind read-only source/toolchain roots, output/tmp roots, executable directories, cwd/root selectors and inherited streams from actual receipts.

• Implement launch integration that creates a fresh compatibility process context, supplies only its selected routes, and never grants global named, provider, device, raw-block or kernel process-control endpoints.

• Implement deny-only uid/gid/group/mode/ACL checks after native capability admission; test uid 0, chmod/chown-like metadata and executable permission changes cannot manufacture access or bypass a capability ceiling.

• Implement explicit root/cwd/PATH resolution confined to delegated namespace/executable roots; environment text, absolute paths and .. cannot escape the realm or select an undelegated service.

• Implement resource accounting for process/thread/fd/memory/temp and in-flight work, with deterministic exhaustion and no fixed accidental table cap.

• Implement noninteractive build policy: out-of-envelope operations fail promptly with documented errors, without hanging for a hidden prompt.

• Implement realm teardown on normal exit, crash, denied transfer, launch abort, timeout and supervisor failure; retire all descendants/aliases and prove process/realm generation reuse cannot recover prior authority.

• Add two-realm isolation VMs for filesystem, process, credentials, descriptors, service routes and teardown; include malicious message replay.

• Package/start posixd from ext4 after the required native services; keep compatibility orchestration out of rootd and preserve READY/shell ordering.

• Implement runtime exceptional-authority requests from running compatibility processes through their authenticated launch/realm route; resolve only within the caller's existing delegated selector ceiling.

• Bind every grant to exact process/job/realm generations, resolved object identity, permitted operation and explicit one-shot/invocation/transaction lifetime. Never turn approval into a broad directory or reusable admin grant.

• Extend trusted prompt descriptions for compatibility programs to show executable provenance, operation, object and lifetime; escape untrusted labels and keep labels/argv/paths non-authoritative.

• Preserve automatic same-session secure attention, trusted y/n plus Enter decisions, renderer acknowledgement and fresh-input fences on serial and framebuffer TTYs. Untrusted PTY output cannot approve or spoof a prompt.

• Deliver approved grants to the exact still-running process using explicit caller-local slots and tracked revocable aliases; reject stale, replaced, cancelled or already-exited recipients and clean partial delivery.

• Implement operation-completion/denial/timeout/cancellation/revoke cleanup, including process death during approval and errors after one-shot consumption. No grant remains reusable by a later process or shell command.

• Support exact-entry unlink/rename/truncate and reviewed recursive transaction envelopes; require a fresh explicit policy for any traversal scope, and prove rollback/partial-progress rules without ambient parent-directory write.

• Add interactive VMs for approve, deny, revoke, malformed grant, object replacement, process exit, wrong TTY, replay and two-realm isolation; add a noninteractive build VM proving no prompt or silent escalation occurs.

Files, descriptors and namespace semantics

Weight: 6%; accepted: 0/15. Owning issue · posixd PR 5.

• Implement per-process fd tables distinct from shared open-file descriptions; record rights, offset, status flags, inheritance and alias count.

• Implement open/openat/close and dup/dup2/fcntl duplication with atomic replacement, lowest-free allocation and complete transfer cleanup.

• Implement read/write/pread/pwrite/readv/writev and lseek as required, covering zero/short I/O, shared offsets, append atomicity, EINTR and nonblocking.

• Implement pipe endpoints, EOF/hangup/broken-pipe semantics and bounded buffering; descriptor closure must wake exactly the affected waiters.

• Implement stat/fstat/lstat/fstatat, readdir and seekable directory iteration with stable identity, correct dot entries, mode/size/link counts and source-qualified ctime/mtime/atime behavior.

• Implement mkdir/rmdir/unlink/link/symlink/readlink/rename variants required by the workload, with exact-entry authority and atomic visibility; cross-filesystem operations fail deterministically without partial mutation.

• Resolve the existing held-directory pin restrictions against POSIX cwd/open-object rename/unlink expectations; implement safe object lifetime and namespace detachment without reverting to path-based reopening or stale grants.

• Implement truncate/ftruncate, sparse growth, fsync/fdatasync and durability contracts; test concurrent access, ENOSPC and interrupted failure.

• Implement required mode/umask/ownership/access/ACL semantics with an explicit trusted metadata source. ACL byte preservation alone is not permission enforcement; unsupported provider behavior must be explicit.

• Implement mkstemp/temp-directory and atomic output replacement semantics within delegated tmp/output trees; no host /tmp or ambient search.

• Implement required advisory locks with process/open-description lifetime, contention, cancellation and crash cleanup for Cargo/Git/build tools.

• Implement poll/select readiness, timeout and cancellation using race-free event registration rather than periodic busy loops or fake timeouts.

• Provide only manifest-required local socket/socketpair semantics through bounded endpoints. Network sockets remain unavailable without later networking authority; device-node names alone grant no device access.

• Test symlink/parent traversal, rename races, fd/PID reuse, shared offsets, directory lifetime, revoked handles and mutation outside scope.

• Add multi-process build-style filesystem VMs for parallel files, atomic rename, locks, large trees, long paths and explicit resource exhaustion.

Memory, threads and blocking primitives

Weight: 6%; accepted: 0/12. Owning issue · kernel PR 3.

• Inventory required allocation/mmap/protection/shared-memory/thread interfaces from selected tools and distinguish missing mechanisms from libc adapters over existing capabilities.

• Implement authorized anonymous allocation and release for growing heaps/stacks, with checked alignment, zero initialization, quotas and OOM cleanup.

• Implement required private/file-backed mmap, munmap, mprotect and synchronization behavior; preserve W^X, backing rights, dirty data and revocation.

• Specify thread/process address-space ownership, thread start/exit/ join/detach, stack guards and cleanup with no unintended capability inheritance.

• Implement per-thread TLS allocation, access base and destructor lifetime, integrating ABI and loader contracts; isolate errno and thread data.

• Implement mutex/condition/rwlock/once/TLS-key primitives required by libc/tools with correct atomic ordering, wakeup ownership and destruction.

• Implement race-free check/register/block/wake and actual monotonic deadlines; test notify-before-wait, wake-after-cancel, spurious wakeups, lost wakeups, priority/fairness effects and generation reuse.

• Define fork interactions with multiple threads, atfork handlers, runtime locks and child state; no inherited lock may require a vanished thread.

• Specify unwind/exception support needed by imported C++/Rust tools separately from native abort-only components; do not enable unwinding across kernel, IPC or incompatible FFI boundaries.

• Provide explicit clock and entropy access needed by runtimes. Distinguish reproducible timestamps/test randomness from security randomness; never satisfy a cryptographic entropy request with deterministic fixture data.

• Add stress/failure VMs for mapping protection, concurrent allocation, threaded compilation, TLS isolation, wakeups, joins and teardown under OOM.

• Profile allocation, faults, mapping transitions and synchronization; optimize only measured costs after safety and lifecycle tests pass.

Process, fork/exec/wait and signals

Weight: 6%; accepted: 0/13. Owning issue · posixd PR 5.

• Specify fork's exact snapshot, return values, native generation, POSIX PID, shared open descriptions and allowed capability inheritance. A shell's descriptive subshell checkpoint is not a process fork.

• Implement correctness-first private address-space copying unless a separately reviewed copy-on-write mechanism is justified; duplicate only selected memory/descriptor rights, never a service's private receive authority.

• Implement atomic child publication and full unwind for allocation, mapping, transfer or startup failure; parent state remains usable and no half-started child or leaked authority remains.

• Implement execve/exec-family replacement using exact executable identity, manifest, realm policy, argv/env, inherited descriptors and signal rules; success replaces the image, failure preserves the prior process.

• Implement posix_spawn/file actions if required by imported tools; preserve the same inheritance/security semantics and test fork/exec equivalence where specified. Do not fake fork by always taking a spawn-only path.

• Implement wait/waitpid and required wait options with exact child status, zombie retirement, multiple waiters, interruption and PID reuse safety.

• Implement process groups/sessions and terminal foreground ownership entirely within delegated namespaces; numeric group IDs cannot grant control.

• Implement sigaction, masks, pending delivery, default/ignore/caught dispositions, unblock ordering and supported signal sets with explicit state.

• Implement safe user handler entry/return, alternate stack if required, validated restored context and async-signal-safe runtime paths; never unwind across unauthorized frames or trust caller-provided privileged CPU state.

• Implement signal-driven EINTR/restart, SIGCHLD/wait ordering, SIGPIPE, stop/continue and terminal job-control behavior required by the profile.

• Implement per-process CPU/resource queries and required limits with real counters; elapsed wall time and child CPU time remain distinct.

• Add fork/exec/wait VM matrices covering descriptor aliasing, close-on-exec, environment, cwd, TLS, signals, multi-thread fork, failures, concurrent children and termination while authority demand is pending.

• Add cross-realm signal/control denial, stale-PID replay, descendant cleanup and repeated fork/exec exhaustion/recovery VMs; verify no residual caps.

C runtime and libc

Weight: 5%; accepted: 0/12. Owning issue · lib-cstd PR 3.

• Define static/shared libc artifacts, C headers, symbol/export versioning, startup objects, calling conventions and supported C language ABI.

• Implement C entry/exit, argc/argv/env/auxiliary data, atexit and initialized runtime state from validated launch input; no ambient discovery.

• Implement memory/string/byte functions with overlap/alignment/ zero-length/overflow tests and documented FFI pointer contracts.

• Implement malloc/calloc/realloc/free/aligned allocation using Memory, threads and blocking primitives, covering ownership, failure atomicity, zeroing and threaded use.

• Implement errno and error strings per thread with stable native error mapping; unrelated calls/threads must not overwrite each other's state.

• Implement buffered stdio, formatting/scanning and conversion surfaces required by tools; cover partial I/O, flush-on-exit, stream locking, binary data, locale, numeric bounds and varargs ABI.

• Implement libc file/directory/poll/terminal adapters over posixd; no direct provider routes or host-OS syscall fallback may bypass mediation.

• Implement process/signal/thread adapters over reviewed native mechanisms; libc process-global state must have defined fork/exec behavior.

• Implement time/sleep, locale/ctype/multibyte, environment, sorting, search and required math/runtime helpers with deterministic documented behavior.

• Implement only required additional C/POSIX interfaces identified in Scope, repository and build inventory; track every unsupported extension with explicit behavior and tool configuration/port justification, not success-returning stubs.

• Build independent C conformance probes for layout, linking, constructors, TLS, allocation, stdio, files, threads, signals and process lifecycle.

• Validate FFI safety and C/Rust interoperability under errors, malformed inputs and stress; publish rustdoc/header/manual contracts and pass full strict CI for lib-cstd and changed consumers.

Compatibility ELF and runtime linking

Weight: 4%; accepted: 0/10. Owning issue · dynlinkd PR 3.

• Inventory emitted ELF/interpreter/dynamic tags, relocations, symbol versions, TLS models, constructor/finalizer and exception metadata from exact selected compiler/runtime packages.

• Define/version a compatibility artifact contract distinct from native abort-only/no-TLS/no-init-fini policy; preserve rejection of unsupported native artifacts instead of simply deleting existing guards.

• Implement required relocations and dynamic symbol rules with exact bounds, dependency closure, cycle/duplicate behavior and no ambient library search.

• Implement static/dynamic TLS layout and per-thread/module lifecycle with checked template/BSS alignment, unload rules and Memory, threads and blocking primitives synchronization.

• Implement ordered constructors/finalizers and runtime teardown with failure handling; no initializer executes before validation and final mappings.

• Implement declared runtime library loading needed by Python modules and compiler plugins/proc macros; restrict dlopen-like search to granted library roots and retire mappings/aliases only after their users are gone.

• Implement required unwind registration/lookup in compatibility userspace only; validate metadata and keep native/kernel abort policy intact.

• Enforce W^X, relocation/RELRO permissions, manifest identity and dependency closure for imported objects; reject text relocation/lazy binding/ IFUNC modes unless separately required, designed, tested and approved.

• Test malformed ELF, dependency substitution, TLS races, constructor failure, symbol ambiguity, plugin teardown and out-of-realm library lookup.

• Run actual compatibility ELF/TLS/C++ exception/Rust runtime VMs and native-loader regression scenarios with strict warning-free component CI.

Shell, utilities, help and manual pages

Weight: 5%; accepted: 0/18. Owning issue · exsh PR 3.

• Compare exsh's maintained POSIX conformance register and actual build scripts against the selected POSIX shell standard; enumerate remaining syntax, expansion, built-in, signal, group and stopped-job gaps with tests.

• Complete standard POSIX shell behavior needed for ordinary scripts and all remaining mandatory profile items; preserve native descriptor/job authority and distinguish true fork from in-process descriptive state copying.

• Implement compatibility-program launch from exsh without executable-name/argv-specific authority semantics; tools request/fail operations on their own, within the launch envelope.

• Complete pipeline/redirection/substitution/here-document/background/ wait/trap/job-control interactions against real POSIX processes and groups.

• Test configure/build scripts with spaces, long argv/env, nested substitutions, many descriptors, interruption and concurrent output; remove incidental shell storage limits through caller/resource-owned growth.

• Inventory native utility command/option gaps against build recipes; implement required clean-room behavior in thematic modules and record where an explicitly inventoried extended GNU tool is required instead.

• Preserve history/editor/cursor/erase, independent and mirrored TTYs, serial/fbcon trusted consent, output drain and repeated-command behavior under build load; add focused and existing regression VM coverage.

• Run shell/utility conformance fixtures plus a miniature parallel build workflow, checking exact output/status and zero authority leakage.

• Specify an internal exsh help command with Bash-like behavior: no-argument topic listing, pattern/topic selection, short description (-d), manual-style output (-m), synopsis (-s), option errors and match/no-match exit statuses. Verify combinations against the selected Bash reference.

• Implement help from exsh's authoritative built-in/topic registry, documenting actual exsh behavior rather than advertising unimplemented Bash extensions; it must not spawn an external executable or acquire filesystem authority for built-in help. Author original explanatory text.

• Add unit and serial/PS2 harness tests for help listing, topic/pattern selection, flags, invalid requests, redirection, pipelines and exit statuses.

• Specify coreutils man: section/name lookup, disambiguation, multiple pages, search/index behavior, terminal versus redirected output, missing-page errors and scoped manual-directory discovery.

• Implement man as a native coreutils applet with readable paging, scrolling/search/quit and plain-text fallback for pipes; safely parse the chosen documented man format and never execute page macros, escapes or embedded commands.

• Define stable manual sections/names for all CLI commands/built-ins, IPC interfaces and Rust/C linkage APIs; inventory every exported interface and require an indexed page or a clearly linked owning API page.

• Write/package CLI manual pages covering syntax, options, examples, statuses, authority needs and errors for every tool, including help, man, boot-tool, sha2-tool, exsh and extop; include admitted extended-tool manuals only under their declared source/license/manifest policy.

• Write/generate IPC and Rust/C API manual pages with ABI/version, request/reply layout or signatures, safety/ownership/lifetime/authority, errors, examples and cross-references to canonical rustdoc/header/manual text.

• Install man pages/indexes on ext4 as build outputs with explicit read-only lookup authority; environment paths cannot broaden the manual scope or cause execution. Make docs available without network access on both images.

• Add coverage/freshness and malformed-page tests plus serial/PS2 man navigation, resize, pipe/redirection, missing-page and denied-root VMs. Verify every CLI/interface inventory entry resolves to useful current content.

Extended payloads and image isolation

Weight: 4%; accepted: 0/9. Owning issue · integration PR 12.

• Implement a versioned third-party payload manifest containing name, version, source digest, license/notices, target, recipe/patch digests, features, runtime dependency closure, dynamic dependencies and realm authority policy.

• Define offline source ingestion and reproducible recipe storage; keep imported sources/patches separate from EriX-authored ISC implementation and never add imported libraries to trusted EriX Cargo dependencies.

• Add explicit runtime.extended-dev.toml and runtime.extended-release.toml, labeled non-clean-room in metadata/output. Preserve existing clean runtime.dev.toml and runtime.release.toml semantics.

• Enforce clean-profile exclusion across configuration inheritance, local overrides, aliases, caches, transitive libraries and packaged contents; test intentional imported-payload contamination fails closed.

• Enforce a reviewed extended-release subset; exclude development-only generators/test harnesses/debuggers and unneeded dependency libraries.

• Verify every admitted target ELF and declared DT_NEEDED closure, source/license/recipe record and authority envelope; reject unknown payloads, mismatched targets, dependency-only orphans and mutable unpinned sources.

• Reconcile the phase inventory with newly discovered packaging and documentation dependencies before admission; update normative inventory, manifest schema/records and tests rather than silently expanding imports.

• Package admitted tools on ext4 with bounded executable/library manifests; the build realm gets no raw block/device/key/global discovery or network capability from extended-image selection.

• Test all four profile builds, labels, artifact inventories and clean-room exclusion independently; extended-tool success never certifies clean-room implementation provenance.

EriX-hosted imported toolchain

Weight: 5%; accepted: 0/19. Owning issue · integration PR 12.

• Pin exact upstream sources, compiler versions, recipe options and licenses for every selected tool/runtime; create a dependency-ordered offline bootstrap graph distinguishing build-machine, EriX-host and output targets.

• Implement/review EriX target support and sysroot integration for Rust/LLVM/C tooling, including actual std OS bindings over lib-cstd, TLS, threads, process, files and time. A target JSON alone is not host support.

• Build target core, alloc, std, proc_macro, compiler runtime and test libraries; separate imported runtime payloads from trusted native component dependencies and record each runtime link closure.

• Cross-build EriX-hosted rustc, cargo, rustdoc, rustfmt, clippy-driver, LLVM code-generation libraries and Rust linker support from selected upstream sources against EriX libc/sysroot and Rust OS bindings; execute each within an EriX realm. Retain exact static/dynamic link closure evidence; copying or merely relabeling Linux binaries is not a compiler port.

• Build from source and verify EriX-hosted LLVM tools against the EriX sysroot: clang, clang++, lld, llvm-ar, llvm-ranlib, llvm-nm, llvm-objcopy, llvm-strip, llvm-readobj, llvm-readelf, llvm-size, and llvm-config when the recipe requires it.

• Build only declared compiler-rt, libunwind, C++ runtime and compression/runtime dependencies; test C/C++ allocation, TLS, threads and exceptions as required by those exact compiler binaries.

• Port/verify Python 3 and required standard modules, including the selected compression, FFI and optional database extensions used by EriX scripts.

• Port/verify CMake, Ninja, GNU make, pkgconf/pkg-config and declared bash use; test generated build rules, subprocess pipes and parallel job limits.

• Port/verify offline Git operations: init/status/diff/log/checkout, exact local revision resolution and offline Cargo Git dependency use; disable fetch/network paths and preserve exact commit identity in manifests and caches.

• Port/verify archive/compression tools: tar, gzip, xz, zstd and bzip2, with reproducible round trips, permissions, symlinks and path-escape rejection.

• Port/verify required patch/diff/cmp/find/grep/sed/awk/sort/install and file/object-probe behavior not supplied by native tools; record exact options.

• Port/verify extended-dev Autotools support: m4, autoconf, automake, libtool, bison, flex and Perl with a representative configure/build fixture.

• Admit dependency-only zlib/bzip2/liblzma/zstd/libarchive/libuv/libffi/ sqlite/pcre2/expat/gettext/iconv/terminfo/readline components only when selected tools require them; disable optional TLS/download/network features for Phase 6.

• Resolve required image/filesystem, Markdown and TeX tool dependencies through Extended payloads and image isolation or clean-room equivalents. No unlisted helper may run on the external host during the final build to fill a missing guest tool.

• Require every tool's smoke command, deterministic exit and minimal startup capability test before admission; version output alone is insufficient.

• Run functional fixtures: Rust program/crate, offline Cargo workspace, build script and proc macro, C/C++ compile/link, Python bootstrap scripts, CMake/Ninja/make, local Git and archive/text round trips.

• Run each tool class under missing/revoked grants, uid 0 metadata, out-of-tree paths, device names and unavailable network; verify denial and teardown without a compiler/tool-specific launch exception.

• Profile real compiler/workspace builds and fix evidenced substrate bottlenecks through Integration profiler and measured optimization, preserving per-job resource ceilings and exact errors.

• Rebuild the selected upstream Rust/LLVM toolchain and required runtime closure inside an extended development EriX realm using the supplied offline sources, recipes, dependencies and cross-built EriX-hosted bootstrap compiler/sysroot. Require the delivered build to work without unrecorded porting changes, implicit downloads, Linux executables or host build delegation. Verify EriX libc/ABI linkage, execute the guest-built tools and compile/link/run Rust and C/C++ fixtures, including build scripts and proc macros. Use the rebuilt compiler for at least one required full EriX build. Retain exact source/patch/bootstrap/tool/runtime hashes, complete logs, actual outcomes and measured memory/time requirements under explicit build quotas. Cross-compilation and version output alone do not satisfy this acceptance.

Native tools and full build/packaging pipeline

Weight: 5%; accepted: 0/21. Owning issue · integration PR 12.

• Provide a signed/hash-verified source bundle of all exact component revisions, locks, recipes, configs and local dependency metadata with no EriX precompiled output. Reject missing or unexpected sources before building.

• Implement the build realm: immutable source/toolchain inputs, separate write-only-as-needed build/output/tmp trees, explicit execution and child lifecycle authority, fixed locale/time policy and bounded resources.

• Resolve source-write assumptions by declaring writable generated worktrees separately from immutable originals; never silently grant compiler writes to the source authority root.

• Adapt component orchestration and Cargo override/lock resolution for fully offline EriX execution; record every invoked guest tool, target, input/output digest and job dependency. Remove host /proc//sys assumptions.

• Build EriX-hosted boot-tool, sha2-tool and every other maintained build helper inside EriX before using them to produce final artifacts; the first two use native EriX APIs through Native tools and full build/packaging pipeline, not a POSIX-only port.

• Build the complete target/profile graph from Scope, repository and build inventory, including all services/libraries, kernel, EFI bootloader and Integration test artifacts; fail if a catalog entry is silently skipped due to missing build configuration.

• Generate complete dynamic/launch/boot manifests and signed boot.img inside EriX, with deterministic source epoch, ordering, padding, feature identity and no preassembled host artifact substitution.

• Resolve current dd, debugfs, mkfs.fat, mkfs.ext4, mcopy, mmd, sgdisk, truncate/hash/compression and Python packaging dependencies. Prefer a reviewed image-file-only path using owned code where appropriate; any imported alternative needs Extended payloads and image isolation admission and actual guest functional tests.

• Assemble GPT, FAT ESP and ext4 partitions into ordinary output image files inside EriX, without granting the build realm raw block, mount administration or access to the currently running disk device.

• Build clean dev/release and explicitly selected extended profiles with equivalent validated boot/runtime closures; verify clean images exclude imported compiler payloads even though an imported compiler produced them.

• Define least-authority artifact signing: a build requests signing of an exact reviewed artifact identity under a dedicated test/development key policy; no private key bytes, broad key service or release key enter the realm.

• Produce checksums, compression, manifests, generated API references and complete technical manual within EriX using the declared tool closure. Run warning-free guest fmt/Clippy/unit/documentation checks on built sources.

• Implement restartable build steps with verified input/output cache identities, bounded parallelism, meaningful progress and deterministic cleanup; final clean-build evidence must disable reuse of prior EriX outputs.

• Test failed compiler, OOM/ENOSPC, interrupted build, malformed cache, signer denial and partial image creation; retain diagnostics and remove only owned temporary artifacts without corrupting source or running media.

• Verify image-file parsing, signatures, partition/filesystem metadata, payload closures and reproducibility inside EriX before exporting results for independent host inspection/boot orchestration.

• Separate boot-tool and sha2-tool command/format/hash logic from platform I/O; specify native EriX and Linux backends sharing exact CLI, errors, output and artifact formats without routing the EriX backend through libc.

• Port sha2-tool to native startup/CLI/stdio/file capability APIs; stream large inputs, preserve stdin/file modes, bound temporary storage and retire all input/output grants on success, denial and interruption.

• Port boot-tool image operations to native EriX file/stream APIs; preserve build/inspect/verify/signing-payload semantics and the detached signer boundary. Neither platform backend may gain implicit private-key access.

• Keep Linux targets usable with the existing CLI and build recipes; test shared logic plus both backends and byte-identical image/hash output from the same fixture inputs, including empty, large and malformed files.

• Package both native executables/metadata/man pages on ext4, add scoped launch contracts and new serial/PS2 in-OS CLI tests for both tools; test wrong/missing grants and partial-output cleanup without program-specific launch authorization.

• Use the newly guest-built native tools in Two-generation self-hosting demonstration for image operations and checksums; show Linux regression CI remains green and no host fallback or POSIX adapter secretly performs their native guest operations.

Two-generation self-hosting demonstration

Weight: 6%; accepted: 0/16. Owning issue · integration PR 12.

• Freeze the acceptance source/toolchain/recipe/image hashes, complete output inventory, resource/timeout policy and exact build command in a reviewed runbook. Fix all prerequisites before declaring the timed demonstration started.

• Provision a private seed extended image with admitted EriX-hosted tools and source-only inputs. Use an empty output tree and no prior EriX object, incremental, image, generated-metadata or host tool cache.

• Boot the seed EriX and record guest identity, native process/realm provenance, mounted authority inventory and tool versions; disable networking and host shared-directory/build-RPC fallbacks.

• From exsh in that EriX session, execute the complete build command. Record each compile/link/generate/sign/package step as an EriX process with exact input/output evidence and actual exit status.

• Complete all Scope, repository and build inventory outputs, including every EriX component, signed boot image, UEFI loader, clean dev/release disks, selected extended disks and generated documentation/manifests. Compare inventory cardinality and hashes; a missing target or substituted prebuilt output fails the demonstration.

• Run guest fmt/strict Clippy/unit/doctest checks and relevant guest tool/authority-negative tests on that graph; preserve zero-warning full logs.

• Validate partition/ELF/signature/source closure, then export only completed artifacts/evidence through an explicitly authorized path. The host may record, independently verify and boot them, but may not repair or assemble a missing build output.

• Boot the newly guest-built clean dev and release images and run their canonical runtime probes; boot the guest-built extended-dev image for the second-generation build. Record exact booted image hashes.

• In that newly built EriX, provision the same immutable sources/tools and fresh empty output/tmp trees, then perform a second complete build without importing first-generation compiled EriX artifacts or mutable caches.

• Compare first/second-generation complete artifact inventories and deterministic bytes/signatures using the fixed inputs. Investigate every difference; normalization is allowed only for fields explicitly specified before the run, never to erase unexplained payload differences.

• Run the complete maintained VM catalog and post-image probes on matching guest-built artifacts. The external supervisor may start test VMs; nested virtualization inside EriX is not required and must not conceal a host-side build step.

• Demonstrate source read-only, output/tmp confinement, executable scope, no device/raw-block/key/network/global discovery and no cross-realm control; test denied access, interrupted build and complete realm teardown.

• Profile the self-host builds, report actual elapsed/CPU/I/O/memory figures and apply the predeclared budgets; close proven bottlenecks through reviewed fixes and a new complete evidence cohort, not partial retries to green.

• Publish a reproducible evidence bundle: source graph, manifests, tool licenses/recipes, commands, full logs, profile summaries, negative tests, output hashes/signatures, boot/test results and independent review.

• Include Signing, rootfs verification and UEFI Secure Boot trust-chain verification in both generations: custom-key Secure Boot, signed boot image and all rootfs authority/code objects. Exercise tampering/revocation failures before declaring the guest-built result accepted.

• Initiate/observe the build through Extensible serial/PS2 CLI input harness's real serial/PS2 CLI input paths, run native boot/hash tools, and verify Consoles, vttys, mouse, TUI and boot logo's independent TTY/default-clear behavior, vtty switching, mouse selection/paste, boot logo and help/man/extop acceptance on the newly produced images.

Final CI, audits and alpha-review handoff

Weight: 4%; accepted: 0/15. Owning issue · integration PR 12.

• Run final fmt, default/all-valid-feature strict Clippy, unit tests, doctests, target/profile builds and rustdoc for every altered repository at its exact final signed revision, with no warnings and no unexplained skipped tests.

• Verify every new runtime feature has positive, authority-negative, malformed-input, interruption/cleanup and bounded VM integration coverage.

• Run the full old-plus-new VM catalog and all canonical/post-image probes; reconcile authored scenario counts, source/worker ownership, expected exits, images and retained failures. Existing 486 cases are a baseline, not a fixed future denominator that permits dropping tests.

• Enforce real per-scenario hard/stall deadlines and owned-process cleanup in CI; test stalled guests/helpers fail and release their worker. Report progress throughout long full-build jobs without fabricating liveness.

• Monitor exact-head CI for every repository, including nested crates and older unit/VM regressions; classify pending/cancelled/stale/missing evidence separately. Fix failures and warning-bearing green jobs before acceptance.

• Keep Rust fmt/Clippy/tests in each crate's canonical ci.yml, including Integration's library job; remove unsupported Forgejo workflow permissions fields and use authorized integrations only for needed capabilities.

• Re-run the independent whole-codebase Whole-codebase authority and quality audit, Rustdoc, missing_docs and documentation audit and check zero deprecated APIs, over-limit authored code files, missing inline docs and unresolved ambient/residual/unwanted explicit authority findings.

• Verify compiler/dependency commit-pin policy, clean/extended image isolation, signed source/artifact provenance, reproducibility and rollback/ upgrade behavior for changed persistent or ABI contracts.

• Re-run uninstrumented startup and declared build-performance gates on the final graph; an earlier candidate's speedup or predecessor CI cannot certify a later graph.

• Reconcile every component's canonical README/ARCHITECTURE/ROADMAP, docs/phases/6.md, manual/API references and operator self-hosting runbook with observed behavior, supported limits and exact final evidence.

• Push all final signed feature/posix-compat trees and coherent Integration pins; verify remote heads/signatures and their own terminal CIs. Do not silently merge, retag, rewrite history or replace main images.

• Close canonical acceptance criteria using the linked acceptance contract, record final percentage and remaining later-phase non-goals, and request explicit promotion direction for accepted images. Do not declare Phase 6 complete before Two-generation self-hosting demonstration, Final CI, audits and alpha-review handoff actually pass.

• Close the supplementary Public Forgejo issues and PRs, Extensible serial/PS2 CLI input harness, Signing, rootfs verification and UEFI Secure Boot, Consoles, vttys, mouse, TUI and boot logo and Whole-codebase authority and quality audit, Rustdoc, missing_docs and documentation/Shell, utilities, help and manual pages, Native tools and full build/packaging pipeline gates, including signed downloadable boot artifacts, all-file authority verification, real-input CLI coverage, native tools, manuals and human-legible documentation/code.

• Reconcile public issues, PR checklists, evidence links and this tracker; remove "WIP: " only from genuinely accomplished PR goals and leave unresolved/dependent work visibly open.

• Prepare the v1.0.0-alpha.1 manual-review dossier: complete source graph, self-host proof, security/CI/performance results, licenses, custom-key enrollment/recovery instructions and known non-goals. Wait for explicit manual approval before merges, version promotion, release tags or artifact promotion.

Public Forgejo issues and PRs

Weight: 2%; accepted: 3/10. Owning issue · meta PR 4.

• Verify the deployed Forgejo version, authenticated identity and minimum organization/repository permissions using the authorized credential without exposing it; do not assume another version’s API support or silently widen privileges.

• Create public work-package and bounded implementation/audit issues in the owning repositories, with descriptive titles, dependency links, acceptance criteria and authority rationale. Preserve confidential coordination identifiers and evidence.

• Maintain an idempotent issue/PR mapping and update process; detect existing objects before creation, preserve human edits, and avoid duplicates or unsupported completion claims. Keep this master checklist, totals, dependencies and evidence current whenever scope or acceptance changes.

• Ensure every altered repository, including docs/meta/new libraries, has a feature/posix-compat PR with the exact "WIP: " title prefix after its first pushed checkpoint; use draft mode as well if supported, not instead of the required prefix. Link dependent PRs and the matching component graph.

• Keep PR descriptions current with implemented versus planned scope, security decisions, validation/failures, exact CI revisions and issue references. Publish concise meaningful progress rather than private raw logs.

• Make public updates through the user's authorized account/configured identity without mentioning AI-agent attribution; never assert the user has personally reviewed, approved or signed something when that has not occurred.

• Keep API tokens, signing secrets, private paths/logs and sensitive vulnerability detail out of public issues, PRs and artifacts; restrict actual security reports as required while recording a non-sensitive tracking link.

• For every new repo, verify absence, create remotely from meta as template, verify static-file inheritance, clone, branch, specialize and open its WIP PR. Add audit/CI/docs/manual/catalog and public issue records before consumers depend on it; no local-first blank repository substitution.

• Close an issue and remove "WIP: " only when its declared goal and required cross-repository/CI gates actually pass; keep the coordinated Phase 6 PR WIP until the whole phase is accomplished. Readiness is not merge approval, and successful Phase 6 is not alpha-release approval.

• Reconcile all altered repositories, open issues, PR states and local progress at each milestone/final handoff; link each accepted result to its signed revisions and public review evidence.

Extensible serial/PS2 CLI input harness

Weight: 3%; accepted: 0/17. Owning issue · integration PR 12.

• Inventory current serial/physical helpers, guest-script injection, direct orchestration launch and output oracles; separate genuine CLI tests from low-level protocol/kernel fixtures before migrating them.

• Define a versioned input-backend interface for capabilities, connect/select-session, send text, press/release keys, modifiers/chords, synchronization and teardown; keep scenario intent independent of transport.

• Implement serial input over an explicitly selected UART/PTY route, including encoding, line endings, fragmented escapes, partial writes, reconnect policy and bounded backpressure without bypassing seriald/ttyd.

• Implement PS/2 keyboard input through the emulated device path, including scan codes, make/break, modifiers, repeat, arrow/delete and secure attention; do not inject directly into the shell or trusted-input endpoint.

• Make unsupported backend capabilities explicit and reject them before a test starts; document how a future USB/HID or other backend plugs in without changing every scenario or inventing synthetic trusted input.

• Bind commands and observations to one exact TTY/session per run. For independent terminals, PS/2 completion must use its framebuffer/session output, not unrelated serial log stamps; never send a command through both backends and accept whichever output happens to arrive.

• Implement transcript expectations for exact output, status, prompt, cursor/redraw, timeout and completion, with structured failure context; screenshots/framebuffer state must corroborate visual assertions where needed.

• Add fake-backend unit tests for partial input, key-up cleanup, malformed escapes, stuck modifiers, cancellation and stale sessions; hard-bound helper/QEMU lifetimes and retain original status on observation failure.

• Add real serial and PS/2 VM tests for editing/history, pipelines, redirection, Ctrl-C, foreground/background jobs and y/n plus Enter consent; prove ordinary input cannot impersonate trusted approval or another TTY.

• Migrate CLI/tool acceptance scenarios to the shared real-input API, including boot-tool, sha2-tool, help, man, extop and self-host build commands; preserve existing assertions and record every renamed/retired case mapping.

• Keep low-level non-CLI protocol/negative fixtures when needed, but do not count directly launched test scripts or hidden rootd orchestration as primary evidence that a user can operate a CLI tool.

• Run backend coverage in CI for serial-only, framebuffer/PS2-only, independent dual and explicitly mirrored modes; preserve existing hard/stall limits and exact source/image/session evidence.

• Remove superseded one-off CLI input adapters after migration, document authoring a new backend/scenario, and add a coverage gate preventing new CLI acceptance tests from silently bypassing the primary input harness.

• Make physical text injection layout-aware while keeping explicit raw key/scan-code fixtures available; run US/Finnish punctuation, modifier and trusted-input cases under the actual boot preference. Serial sends text bytes directly and must not be translated a second time as keyboard scan codes. Record layout and key sequences; use independent expected vectors rather than the production keyboard translator as its own test oracle.

• Extend the physical backend with PS/2 mouse movement and explicit left/middle/right press/release actions, preserving packet boundaries and validated device ingress; never substitute host clipboard or direct guest terminal-state writes for mouse acceptance evidence.

• Add explicit Ctrl+Alt+Fn selection and target-vtty expectations, including held/released modifiers, invalid targets and switching during output or prompts; observe the selected framebuffer vtty rather than a serial sibling.

• Add reproducible visual/text assertions for hidden/revealed cursor, selection and pasted text, plus early boot-logo screenshots tied to exact image/asset hashes. Preserve bounded observation and input teardown on failures.

Signing, rootfs verification and UEFI Secure Boot

Weight: 5%; accepted: 0/37. Owning issue · bootloader PR 3.

• Inventory the complete trust chain and all authority-controlling root-partition files: executables, libraries, scripts/interpreters, plugins, loader/runtime/launch manifests, service/mount/realm policies, key policy and configuration/includes that can change authority. No code object is exempt because it is imported, generated at runtime or not marked executable.

• Define verification ownership and an authenticated chain from enrolled firmware trust to EFI loader, boot.img, rootfs policy and every admitted executable/library. Existing bare digests are not the requested signature proof.

• Specify a per-file signature or signed catalogue entry authenticating exact final bytes, length, role, relevant metadata/path binding, format/version, dependency closure and signer/policy generation. Every covered file must have verifiable signed coverage; unsigned sidecar hashes are insufficient.

• Specify an acyclic finalization/signing DAG: finish code generation, stripping and capacity/metadata patches before object signatures, finalize authority catalogues before their boot trust anchor, then sign/package final EFI/boot/disk outputs. Avoid circular digest dependencies and post-sign edits.

• Separate firmware PK/KEK/db/dbx certificates/keys from boot/rootfs signing keys and development/build-realm keys; document trust roots, allowed signer roles, rotation/revocation and recovery without reusing a general key.

• Implement signed authority-file generation and verification in maintained tooling with independent known-answer, malformed-format, wrong-role, wrong-key, truncation, tampering and signature-coverage tests.

• Verify policy bytes before applying policy or delegating authority; verify executables and complete library/interpreter/module closures before execution/initializers. Integrity or signer identity alone grants no capability.

• Preserve fresh-object binding from signature verification to use; reject replacement, symlink/race/substitution and stale cache attacks, including lazily read executable pages and reused file handles. Never verify one object and map/execute another or mutable bytes from the same reopened path.

• Define authorized policy/code update and rollback behavior with atomic verified publication, cache invalidation, revocation and interrupted update recovery. Do not promise anti-rollback without a reviewed trusted version/revocation anchor beyond attacker-replaceable disk data.

• Define scoped signing/admission for newly built test programs, Cargo build scripts, proc macros, plugins and compiler outputs before executing them. Bind development signatures to the build realm/output policy; no unsigned output exception or general trusted-system signing oracle is allowed. Separate transient realm-generation-bound admission from reproducible final artifact signatures under fixed declared keys/policy; do not normalize away unexpected final signature differences in Two-generation self-hosting demonstration.

• Implement the build-output signing route with exact artifact identity, authorized operation, finite lifetime and complete cleanup; keep private key material out of ordinary build processes and boot-tool itself.

• Add rootfs tamper VMs for every object/policy class, missing/wrong/ revoked signatures, catalogue substitution, mixed generations and dependency replacement; prove no code runs and no new authority is installed on failure.

• Add an explicit CI signing configuration using a private key from Forgejo secrets for downloadable boot.img; separate local test-key builds from protected signed publication and fail closed when required secrets are missing. Never silently fall back to the repository test key for downloads.

• Restrict signing secrets to approved trusted workflow/ref contexts and an isolated signing stage consuming immutable verified artifacts; untrusted PR/fork code and ordinary compile/test scripts receive no signing key.

• Pass secrets through a reviewed non-logging channel to the narrow signer, scrub owned temporary material on success/failure/cancellation and exclude it from caches, dumps, job logs and uploaded artifacts. Verify secret absence without printing/search-reporting its actual bytes.

• Preserve boot-tool's detached payload/signature/verification contract; record public key fingerprint, exact signing payload/artifact hashes, source graph and signing policy without exposing private credentials.

• Publish an explicitly named signed boot.img plus verification material/provenance per profile/key cohort, and ensure every downloadable disk contains its corresponding exact tested signed payload and rootfs authority closure; verify downloaded bytes independently of local publisher status. Protected CI re-signing/repackaging creates a separately verified/tested cohort, not a byte-identical Two-generation self-hosting demonstration result or permission for hidden host build completion.

• Test protected signing success, missing/wrong secret, untrusted-ref denial, modified input, signer failure and cancellation; publication must stop on failure and no unsigned/test-key output may be mislabeled trusted.

• Implement full supported-platform UEFI Secure Boot packaging with a custom EriX/user-controlled certificate: sign the PE/COFF EFI loader in the firmware-required format and keep its verification material consistent with boot/rootfs trust. An Ed25519 boot.img signature is not firmware EFI signing.

• Provide documented custom PK/KEK/db/dbx enrollment, owner-authorized updates, certificate distribution and revocation/recovery procedures without dependence on a Microsoft signature. Back up existing enrollment and require explicit approval before changing real firmware variables or owner keys.

• Define enforced versus explicitly non-enforced development boot modes and check SecureBoot/SetupMode state where appropriate; never report successful enforcement while firmware is in setup mode or validation is off.

• Add QEMU/OVMF Secure Boot fixtures with private firmware-variable storage and custom enrollment; prove correct-key boot and refusal of unsigned, wrong-key, tampered and revoked EFI images without a permissive fallback path.

• Exercise the full enforced chain with tampered boot.img, rootfs policies, executables and shared libraries; firmware success alone cannot close downstream verification gates. Include both clean and extended profiles.

• Test key rotation/revocation, interrupted updates and documented recovery using independent fixtures, preserving least authority and a usable owner recovery path rather than silently disabling verification.

• Perform a manually approved real-firmware enrollment/boot/rejection validation on the supported hardware baseline; record firmware versions and limitations. OVMF evidence alone is not a claim of universal firmware support.

• Audit signing/verification code and CI boundaries independently, update threat models/rustdoc/man/manual and include malformed crypto/container inputs without introducing third-party code into clean-room components.

• Verify normal signed loading does not retain signer/admin authority in loaders or applications; profile verification overhead through Integration profiler and measured optimization and optimize only exact immutable identities with sound invalidation.

• Include signing/trust tests in the full CI and both Two-generation self-hosting demonstration build generations, using scoped development keys for self-host proof and protected CI signing for downloadable outputs; document the distinct trust policies.

• Produce an operator verification/enrollment/recovery runbook and alpha-review evidence showing the exact EFI→boot→rootfs trust chain, public verification keys and download hashes, with no private signing material.

• Design/version a distinct unsigned user-preference section in boot.img, separate from signed executable/configuration/authority data. Whitelist non-authoritative typed settings, initially keyboard-layout ID; preferences cannot select trust roots, bypass verification, choose executables, alter capability/realm policy or grant device/namespace access.

• Authenticate the container format and section directory/bounds, including the precise permitted unsigned extent. Exclude only that preference payload from the boot signature's authenticated message; verify every security- relevant byte and reject overlap, aliasing, truncation, confused versions and attempts to reinterpret signed bytes as preferences. Give the preference descriptor an authenticated explicit hash policy: no signed section hash may still depend on mutable preference bytes. Any optional corruption checksum for those bytes lives inside their unsigned extent.

• Implement build/read/update tooling for preferences without private signing authority, preserving all authenticated bytes, section extents and signatures. Record separate full-container digest and signed-content identity: preference edits change the former, not the latter; refresh local artifact receipts without falsely claiming an edited image matches published checksums. Coordinate any outer boot-image/catalog authentication so it anchors signed core identity, not a whole-file digest that silently forbids unsigned edits; retain whole-file digests as exact distribution/integrity evidence.

• Parse preferences as bounded untrusted input with deterministic absent/malformed/unsupported-value handling, defaulting keyboard layout to en_US. Malformed preference content may fall back, but malformed authenticated structure or signature failure must still fail closed, never enter fallback.

• Carry the validated preference value to its consumers as explicitly non-authoritative data, distinct from trusted clear-completion and authority handoff fields. Only select packaged, signed, allowlisted keyboard definitions; preference text cannot load a script, plugin, arbitrary path or mapping code.

• Add signature/container unit tests and VMs showing layout-only preference edits preserve Secure Boot/boot-content verification, while changing signed code, policy, bounds, key selection or verification flags is rejected. Test integer overflow, unknown/duplicate keys, padding and recovery defaults.

• Version boot-image/handoff parsing and every consumer's trust classification for unsigned preferences; do not reuse MUTABLE_AFTER_BOOT or descriptors promising all bytes were signature-verified as an unsigned bypass. Update format/coverage vectors, boot-tool/manual docs and negative version tests together, then retire superseded intake under Whole-codebase authority and quality audit without a permissive fallback.

• Keep the optional boot-logo bitmap and its type/dimensions/format under signed boot-image coverage, separate from unsigned user preferences; decode/render it only after authentication. Logo substitution cannot extend the unsigned region, select executable content or alter authority handoff.

Consoles, vttys, mouse, TUI and boot logo

Weight: 2%; accepted: 0/46. Owning issue · ttyd PR 3.

• Add strictly boolean [features].fbcon_clear, default true, to runtime/build configuration, schema, parser, feature identity and documentation; reject malformed values and test omission, true and false.

• Apply the option to early and userspace framebuffer initialization. Clear once before the first console output when enabled; when disabled neither initializer may erase existing content merely because it starts.

• Carry validated framebuffer identity/geometry and an early-clear completion record through the trusted handoff; if early fbcon already cleared the screen, user fbcon adopts it without another clear. Do not treat arbitrary descriptive startup bytes as proof of a trusted completed clear.

• Preserve pixel format/stride/padding, cursor and output continuity; replace conflicting unconditional release/early clears and test that late initialization never erases valid early logs. Normal explicit TUI clearing remains separate from this initialization-only build option.

• Add unit and framebuffer VM coverage for early-only, user-only, both and neither console with clear enabled/disabled; assert exact clear count, final pixels and handoff failure behavior, not just a serial READY marker.

• Set tty_mirror = false in both canonical dev/release images; align sample/extended defaults with independent terminals and retain explicit mirrored fixtures so the optional feature remains tested.

• Validate both enabled paths create distinct shells/sessions with separate input/output/cwd/history/foreground jobs/consent and adequate declared capacity; single-path and no-TTY configurations still work without extra grants.

• Preserve frozen Phase 5 handoff and remaining gates timing comparisons as their original cohort, then measure the new dual-shell default separately using Extensible serial/PS2 CLI input harness session-bound observations. Do not attribute a policy/workload change to a kernel speedup or relax the carried limits; report each terminal's full startup/command evidence.

• Specify/version improved fbcond TUI operations: absolute/relative cursor position, visible cursor, erase regions, colors/attributes, rectangular cell updates, scrolling regions, viewport/resize and frame completion.

• Implement bounded validated rendering batches/dirty regions, geometry/capacity checks and deterministic malformed-request behavior without granting raw framebuffer memory or global-screen ownership to clients.

• Expose TUI through session-scoped tty mediation backed by fbcond, with clear renderer versus terminal ownership. Keep trusted powerbox chrome protected; ordinary clients cannot draw over it or steal focus/consent input.

• Implement serial-terminal equivalents or advertised graceful fallbacks over the same session-level interface; define supported capabilities explicitly rather than claiming compatibility with every ncurses extension.

• Extend the shared terminal parser with required cursor/erase/color and alternate-screen behavior, including extop's existing home/full-erase needs; test split escape sequences, unsupported controls and dimensions.

• Port extop to the new TUI interface with efficient frame updates, resize/navigation, screen restoration and interrupt/exit cleanup; retain its exact process-inspection/control authorities and never add broad console caps.

• Implement trusted-prompt suspension/restoration during a TUI session, ensuring modal input is not consumed by extop and no previous trusted text or stale ordinary frame is replayed after focus/session changes.

• Add parser/renderer unit tests and serial/PS2 visual VMs for cursor, erase, colors, scrolling, resize, extop refresh/quit/Ctrl-C, independent TTYs, prompt interruption and complete session/capability cleanup.

• Profile full versus partial redraw, IPC count and extop input-to- frame latency; fix measured bottlenecks without skipping visible completion, and update IPC/Rust API man pages, tool manuals and operator documentation.

• Define keyboard-layout ownership over layout-independent physical key events; retain driver/inputd raw identity and implement text translation at ttyd or a reviewed shared pure layout layer. Provide signed, clean-room en_US and fi_FI mappings with modifiers, Caps Lock, AltGr, punctuation, Unicode and Finnish dead-key behavior. Keep physical identity, navigation and control chords distinguishable from text.

• Initialize the keyboard text translator from Signing, rootfs verification and UEFI Secure Boot's validated boot preference, default en_US; preserve consistent layout behavior for every physical keyboard client/session without double-translating serial input. Initially select layout at boot; later runtime layout changes require their own state-transition contract, not reinterpretation of buffered input.

• Add a git-ignored local build override selecting fi_FI and include it explicitly in image identity/test receipts. Keep canonical dev/release, extended profiles and clean CI defaulting to en_US; explicit CI layout fixtures test Finnish without allowing a developer override to leak into publication.

• Preserve secure-attention key identity and trusted consent fences; preference changes must not synthesize approval, reinterpret buffered keys or let ordinary layout processing consume trusted y/n plus Enter. Document which chords are physical and which text is layout-selected and display prompts consistently with those rules.

• Add unit/real-input VM tests for both layouts, default/invalid preference fallback, local override isolation, modifier/dead-key release, repeated input, Unicode editor/delete behavior and trusted consent. Test both independent terminals and verify serial byte input remains unchanged.

• Document keyboard selection and preference editing in boot-tool help/man, image/build docs and the technical manual, explicitly identifying unsigned convenience data versus signed security policy and code.

• Replace single-byte-only text emission with checked UTF-8 sequences and backpressure-safe atomic character delivery; define dead-key composition, unsupported combinations, modifier release and pending-state reset on focus/ session/consent changes. Test interrupted multi-byte delivery cannot corrupt commands, leak pending text to another TTY or reinterpret it as trusted input.

• Define multiple framebuffer vttys as distinct live terminal/session generations with their own shell, screen/scrollback, cursor, editing/history, cwd, foreground jobs and input state. Keep virtual-terminal records separate from the existing two physical framebuffer/serial console bindings.

• Specify signed resource/count and creation/retirement policy for configured vttys, with at least two exercised in acceptance. Allocate/reuse only explicitly authorized session resources; an Fn ordinal cannot create processes or grant launch authority. Test exhaustion and safe focus fallback when a shell/vtty exits, without imposing an incidental fixed table limit.

• Implement physical Ctrl+Alt+Fn switching directly to the configured framebuffer vtty identified by Fn. Admit this exact authenticated gesture without a separate manual secure-attention step, independently of keyboard layout; preserve existing trusted controls and reject nonexistent/stale targets.

• Switch display and ordinary input focus atomically by exact live session generation; keep events bound to their receipt-time destination and handle held modifiers/releases without injecting them into the wrong vtty. Independent serial focus remains unchanged; test explicit mirrored mode too.

• Cancel a pending trusted prompt when switching away, retaining the existing cancellation/cleanup contract; never transfer approval state to the destination. Restore ordinary content only after renderer acknowledgement and preserve fresh-input fences if a later prompt is created.

• Retain inactive-vtty output in its own bounded terminal state and restore screen/cursor/selection on activation; handle resize, scrolling and extop alternate-screen updates without exposing another vtty or trusted chrome.

• Add unit and physical-keyboard VMs for direct Fn switching, repeated switching, background output, exit/recreation, stale IDs, modifiers, both layouts, serial isolation and prompt cancellation. Profile switching/memory use and record the multi-vtty workload separately from frozen startup comparisons.

• Implement a framebuffer mouse pointer that starts hidden and becomes visible only on the first authenticated nonzero movement, not button-only, resize or focus events. Define per-seat visibility across vtty switches; distinguish this pointer from the shell's text caret.

• Validate signed deltas, button transitions, geometry and coordinate arithmetic; clip cursor drawing to the viewport and restore underlying pixels correctly during movement, redraw, scrolling, resize and vtty changes.

• Implement left-button press/drag/release text selection and visible highlighting from the owning vtty's ordinary text model, including wrapped lines, Unicode/cell boundaries and scrollback. Bind selection to session and content revision; define updates while output changes during a drag.

• Use conventional primary selection: completing a left-button selection copies its text, and middle-button press pastes it. Keep selection bytes scoped to the owning terminal/session by default; cross-vtty transfer requires explicit user-directed source/destination and realm policy, never a global clipboard or arbitrary screen-reading capability.

• Deliver middle-button paste through the exact destination's ordinary input path with backpressure-safe ordering and no duplicate bytes. Define bracketed-paste/multiline/control-byte behavior so shell paste does not silently execute embedded newlines; require normal explicit submission. Do not apply keyboard layout translation to already selected UTF-8 text.

• Exclude trusted chrome, consent input and other vttys from selection. Mouse selection/paste cannot approve, edit or queue answers to a trusted prompt; reject untrusted escape-sequence clipboard access and keep the host/serial terminal clipboard separate. Retire retained text on owner teardown/reuse.

• Add independent unit and real PS/2 mouse/keyboard tests for initial hiding, button-only packets, first movement, bounds, pixel restoration, selection during redraw/scroll/resize, Unicode, middle paste, backpressure, vtty isolation and prompt races; prove cleanup and zero unintended authority.

• Use the logo asset as the original boot-logo source, recording its exact digest and asset provenance. It is currently a 1024×1024 RGBA PNG. Preserve its artwork/transparency; define deterministic preprocessing/scaling rather than generating a new logo.

• Convert the source at build time into a simple, versioned, bounded bitmap payload with explicit dimensions/pixel/alpha format; package it as an optional signed non-executable boot.img section. Keep general PNG decoding out of the bootloader unless a separately justified design requires it.

• In the bootloader, draw the available authenticated bitmap at the screen's bottom center using validated GOP geometry. Preserve aspect ratio, alpha blend against the existing background and define deterministic fitting/ margins for small resolutions; never stretch or draw outside the viewport.

• Fully validate pixel length, width/height/stride, format, arithmetic, alpha and destination bounds before drawing; test RGBA/BGRA, padding, clipping and overflow independently. Image data grants no framebuffer mapping authority.

• Integrate drawing after the configured one-time clear, in both dev and release paths, independent of early text-log enablement. Preserve the clear-completion handoff so later early/user console initialization does not immediately erase the logo; define temporary text/logo placement and normal console takeover without hiding required readiness/error output.

• Boot normally without the optional logo or a usable framebuffer. Define safe cosmetic-error handling for an authenticated but malformed bitmap; container/signature failure still follows the existing fail-closed policy. Release temporary logo buffers/module authority once no consumer needs them.

• Add Linux and in-EriX asset-conversion/package parity tests and put conversion inputs/tools in the Native tools and full build/packaging pipeline, Two-generation self-hosting demonstration build closure; the final guest-built images must not depend on an unrecorded host-side bitmap conversion.

• Add bounded visual VM tests for logo present/absent, dev/release, clear true/false, early console on/off, both pixel formats and small/normal geometries; assert bottom-center placement/transparency and unchanged text. Test signed-logo tampering rejection and document the asset/format/build options in boot-tool man pages, canonical docs and the technical manual.

Alternatives and tradeoffs

Detailed design and reproduction evidence stays in the owning issues and PRs so this record can show the whole dependency and acceptance picture. Inventory or specification completion is distinct from runtime acceptance. The imported toolchain policy permits a source-built cross-bootstrap compiler that runs on EriX and uses its runtime interfaces. It requires an in-guest rebuild of the selected upstream Rust/LLVM toolchain and both complete EriX build generations. Implementing an independently owned compiler remains later work; rebuilding upstream tools does not imply clean-room compiler ownership.

Tracking and rollout

Current implementation: signed lib-ipc PR 2, aaf2df39700b43507b23ff2007bc0d573c4eea30, adds the strict child-lifetime binding representation, operation 58 and reason 4, after the Kernel #19 design update. Seven new controls pass all eight strict library/shim configurations: 419 wire and 20 shim tests per configuration, eight freestanding builds, formatting, host/native Clippy and private rustdoc, without warnings. The existing kernel-only shim test remains ignored. Original lib-ipc CI 365/366 passes from four complete logs, 494,246 bytes, no warnings. Signed Docs PR 4, 54557713f4afad380c1166f6aa1c1622d3959744, passes 45 tests, two original API exports/regeneration checks, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages with zero final warnings. Original Docs CI 979/980 passes from four complete hashed logs, 773,034 bytes, with 45 tests, the full 2,423-page manual and zero final-pass warnings. Signed lib-capabi PR 2, fbec4919371603044b9c4dd57a35c10633be314f, aligns the shared dependency ahead of Kernel enforcement; all four strict 192-test configurations and original CI 244/245 pass without warnings (141,078 complete log bytes). The static census passes 3,130 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots. Kernel admission, cohort stopping, safe reclamation progress and coherent consumer adoption remain unimplemented; this shared representation does not enable the operation or alter the prior complete image graph. The prior native lifetime/owned-invocation VM evidence below remains valid for its original sources; no new runtime acceptance is asserted. Original Integration 1681/1682 remains queued and corrected 1675/1676 remains running. Running mediator lifecycle, full source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX-in-EriX build generations remain required. No whole acceptance item is added; completion remains 15/460 and 3.48% weighted.

Earlier native terminal checkpoint: signed Integration PR 12, a62d1381f56a01afc692112d9b427205eaeb6a2e, selects signed Kernel PR 3, 37d9c74d6d1209729c520a52a274c1646efe225c, and reconciles the native diagnostic graph. Shared exit/kill terminal ordering passes four strict 704/728-test Kernel matrices, thirteen native build/Clippy profiles and original Kernel CI 608/609 (four complete logs, 739,870 bytes, no warnings). Both maintained native lifetime and owned-invocation VMs pass unchanged 60-second limits. Packaged artifacts match their original outputs, all fifteen component signatures verify, and four current strict 320/321-test Integration matrices pass without warnings. Seven focused checks pass; full 169-helper evidence remains bound to unchanged orchestration bytes. Original Integration CI 1681/1682 is queued; corrected 1675/1676 remains running. Kernel design #19 tracks child cleanup after supervisor loss; only its terminal-refactor prerequisite is implemented. Native binding, safe reclamation progress, running mediator lifecycle, full frame proof, upstream toolchain rebuilding and both complete EriX builds remain open. Static census passes 3,128 authored code files below 1,000 lines and existing pin/lint gates. No whole phase item is newly accepted.

Earlier guarded-preparation checkpoint: signed Integration PR 12, b65183ddb93eb4396d4140a002c3727fec42ff87, selects Exsh PR 3, ffe50612889dd58a45a40d04593a4aa3a3ffa512, for the guarded-preparation VM, now also selecting signed Kernel b762e19d0c16acd605d0f6123994a586cc6fcde1 and the reconciled manual. Kernel issue 18 and Kernel PR 3 track the bounded census failure-policy correction: hosted controls, four strict matrices and thirteen native build/Clippy profiles pass, as do original Kernel CI 606/607 with four complete warning-free logs (739,843 bytes). The actual matching consumer VM passes without warnings; normal bootstrap does not establish reachability of the hosted injected condition. The eleven admission calls and five preparation/retirement calls pass through the existing private route using one explicitly supplied cwd SEND copy. The staged native fixture remains unstarted. Both unique diagnostic markers precede ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 appliance artifacts and complete logs are retained; all 73 original component revisions, actual diagnostic executable and signed startup configuration are verified without warnings. All 169 helpers, seventeen route controls, four strict 320/321-test Integration configurations and ten strict 976-test Exsh configurations pass. Eight actual shell frame observations remain incomplete. Original Integration CI 1679/1680 and 1677/1678 are queued; earlier corrected 1675/1676 is running. Catalog adoption preserves all previously checked implementation bytes, with focused source checks passing. An initial Git fixture environment failure is retained alongside its corrected-environment result. Static census passes 3,127 authored code files below 1,000 lines and the existing pin/lint gates. Original Exsh CI 271/272 fails full frame proof despite passing all 976 Rust tests and 355 checker controls; all four logs are complete (320,166 bytes) without warnings, with 101/68 unresolved runtime/all observations. Signed Posixd documentation, 9b031a8c2f996491a322046a4f2acd5dacdc55c2, corrects stale producer-custody and endpoint narrowing claims; original CI 17/18 passes with complete warning-free logs. Signed manual correction, 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, passes 45 tests, the full 2,419-page build, all 445,847 word bounds and visual review of three changed pages, with zero final warnings; original Docs CI 977/978 passes from four complete hashed logs (772,186 bytes), including 45 tests, the full manual and zero final-pass warnings. Launchd 143 passes, while 144 fails Markdown with an unavailable HTTP-500 job log; its cause remains unclassified. The separately passing Rust log is retained. Launchd PR 2 and Procd PR 2 retain the original staging and custody contracts. Typed mediator execution, readiness/configuration/sealing, real client I/O, full source/effect/frame proof, native upstream Rust/LLVM rebuilding and both complete EriX builds remain open. No whole checklist item is newly accepted. Next prerequisite: the signed minimum-bootstrap proposal defines private route ownership, counted startup requirements and independently authenticated readiness. It requires a surviving child-termination owner after Procd loss before any private execution gate opens; SEND revocation alone does not prove child destruction. Original Posixd CI 19/20 passes from both complete warning-free logs (7,212 bytes). No new runtime or wire ABI is assigned.

Update this issue after each accepted implementation checkpoint, changed requirement, significant regression, PR transition or terminal CI classification. Reconcile every checkbox, the 460-item denominator, section weights, completion percentage and links; preserve historical failures and human edits. Add new requirements explicitly and explain denominator changes instead of deleting unfinished work. Every changed repository needs its linked WIP PR and current owning issue; every significant non-security bug/regression needs a canonical bug report with exact identity, reproduction, constraints and evidence.

The implementation order is dependency-led: coherent original sources and authority primitives; complete realm/bootstrap/configuration/seal/client lifecycle; POSIX substrate and imported tools; native guest build/packaging; two full self-hosted generations; final full-codebase, documentation and original CI closure. Supplementary trust-chain, real-input and interface requirements remain part of final acceptance throughout.

Current review: Integration PR 12, Launchd PR 2, Procd PR 2, Rootd PR 2, Exsh PR 3, manual PR 4. The owning-issue links above contain the remaining repository and dependency review links.

Current regressions and evidence gaps include ext4 quota timeout, full layout/source/frame closure and exact-selector input observation. Original Integration 1671/1672 has completed with filesystem VM failures; its complete classification is retained below. The corrected host-directory fixture in issue 63 is closed after its focused tests and both original helper steps pass. These links are examples of open gates, not an exhaustive substitute for each owning audit.

Successful completion establishes the technical baseline for v1.0.0-alpha.1. Promotion of images, PR readiness, merges, tags and release publication still require their applicable explicit review/approval; this checklist does not provide release authorization.

Signed reproducer — 19 September 2026: Integration 76411ed6d96356b20ee0a4c21ad219dacc56340d publishes the explicit scenario and selector. With the documented image signing inputs, run bash scripts/run-scenario.sh tests/scenarios/appliance-disk-image-realm-admission-positive.toml components.toml. The original failed runtime uses the same scenario, implementation and component graph; only roadmap status changed after validation. Its VM result remains FAIL. All 169 helpers and four strict Rust configurations pass without warnings. Original CI 1673 and 1674 are queued. Issue 66 retains the failure. No acceptance credit or complete realm execution is claimed.

Original CI observation — 19 September 2026: CI 1671 finishes with 471 passes/16 failures and CI 1672 with 465 passes/22 failures across all 487 scenarios at c479813423fb71c606fa30e5cf7d4dfb16f557d0. Every failed scenario is an ext3/ext4 positive filesystem case reporting error: qemu timed out after 120s, with scenario status 1. The existing filesystem deadline report retains the expanded matrix; quota issue 18 applies to the quota failure in 1672. All six complete logs are hashed (41,592,478 bytes), with zero warning candidates. Rust, Markdown and the full helper step pass. The zero-realm startup and exact-selector race scenarios explicitly pass in both runs. No common cause, source regression boundary or performance diagnosis is inferred; all actual deadlines and failure statuses remain unchanged, and neither workflow was rerun.

Original corrected-source CI checkpoint — 19 September 2026: at signed Integration 9139c6c5fa, original push CI 1675 passes all 488 VM scenarios. Original PR CI 1676 passes 487/488 and fails only subsystem-e2fs-fat-ext3-htree-positive at the unchanged 120-second QEMU limit. Both pass appliance-disk-image-realm-admission-positive; both Rust and Markdown jobs pass. Six complete hashed logs contain 27,276,890 bytes and no warnings. No rerun or cancellation supplies either result. The ext3 timeout remains tracked in issue 20; its cause is not inferred from the passing sibling run. The private script-route admission defect is corrected and natively demonstrated, while full realm lifecycle, complete frame proof and guest builds remain open.

Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d27e8e2bcefbbf68caf22ece253aac9 implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original Kernel CI 610 and 611 pass from four complete hashed logs, 751,929 bytes, without warnings.

The matching maintained lifetime VM passes its original 60-second scenario with the additional ERIX_KERNEL:CHILD_LIFETIME_OK marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is 012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572.

This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added.

Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.

Signed Integration 581226ab54 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.

Static census: 3,136 authored code files are below 1,000 physical lines. All 74 manifests and 259 full Git selections pass the current policy check; 171 direct missing_docs gates and all 92 conventional crate roots are present. This is not semantic authority or complete private-rustdoc closure. Acceptance remains 15/460 and 3.48% weighted.

Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for ERIX_KERNEL:CHILD_EXECUTION_OK.

Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is 1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.

Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.

This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives GRANT | MINT while binding needs only GRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.

Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.

Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.

A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.

Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: 4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.

Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.

Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.

Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.

Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Further original CI observations — 19 September 2026: original Integration b65183ddb93eb4396d4140a002c3727fec42ff87 now has both terminal outcomes recorded. Run 1679 passes 488/489 catalog cases; only ext4 quota exceeds its unchanged 120-second deadline, retained in bug 18. Its later native/interactive gates are not reached. Run 1680 passes all 489 catalog cases and both native diagnostics, then fails development COM1 directory input after its physical counterpart passes; the last observation is command 6 injection, retained in bug 56. Later release directory/editor gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,238,688 bytes with zero warning candidates. Causes remain unclassified; no unchanged rerun, cancellation or deadline change occurred. Original current Integration 1687/1688 remains queued at its second observation. Acceptance stays 15/460, 3.48% weighted; native toolchain rebuilding and both full EriX-in-EriX generations remain open.

Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.

Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.

Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.

Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.

Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.

The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Historical pre-correction CI reconciliation — 19 September 2026: original Integration run 1673 and 1674, at 76411ed6d96356b20ee0a4c21ad219dacc56340d, are terminal failures. Each passes 487/488 catalog scenarios and fails only appliance-disk-image-realm-admission-positive, reporting the unchanged 45-second serial-progress watchdog. Later native and interactive workflow gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,087,569 bytes with zero warning candidates. Neither workflow was cancelled or rerun.

These runs precede the retained correction at 9139c6c5fa38c139e92520f6d410626b4cf1e4aa; both later original runs 1675/1676 passed that realm-admission scenario. Issue 66 retains the historical evidence and its existing closed state. This does not establish a new current-source regression, full lifecycle acceptance or full guest builds. Current Integration 1689/1690 remains queued at its second observation; acceptance stays 15/460, 3.48% weighted.

Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.

The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.

Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is 606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.

Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.

Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.

The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.

Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.

Explicit install-grant authority design — 19 September 2026: creation and derivation will request the returned grant capability's own rights explicitly, independently of its child slot/type/installed-rights ceiling. The native constructor must stop unconditionally adding GRANT | MINT. Zero means exactly zero rights; it never means inheritance. Only known rights valid for INSTALL_GRANT are admitted. Derivation still requires actual MINT authority and may request only a subset of the source grant's own rights and installation scope. A MINT-only source cannot recreate GRANT that it no longer holds. Genuine multilevel derivation remains possible through an explicitly delegating result.

The coordinated scalar layout uses the low/high halves of arg0 for grant slot/own rights on creation selectors 32 and 54, and source grant slot/result own rights on derivation selector 33. Other creation and derivation fields keep their existing meaning. A checked shared derivation representation will reject other selectors and reserved flags/high destination bits. Root-capability-free creation will expose the own-rights field alongside its existing explicit optional VSpace receipt. Existing zero high halves receive no compatibility default or implicit authority. Every actual emitter must be updated in the coherent original revision graph; no fallback to an older selector or looser receipt check is allowed.

Rootd and Procd will request MINT only for creation paths that actually derive installers. Procd's mediator creation and final installer handoffs will request GRANT without MINT; Procd and Launchd must independently validate actual capability/receipt rights rather than trusting request metadata. Native transfer remains move-only, preserves exact original scope and rights, and neither duplicates nor withdraws cleanup duty. Failed or lost creation/derivation replies must retain the original child generation and existing one-way rollback obligations. A zero-right grant still has its original record and must be dropped before start if it is no longer needed.

Required controls include exact zero/GRANT/MINT/GRANT | MINT requests; malformed/unknown/excess rights with no publication; ordinary installation and lifetime binding from GRANT-only authority; denial of further derivation without MINT; explicitly permitted narrower multilevel derivation; exact move receipts; preservation of source identity, generation and scope; occupied destinations and failure cleanup; and actual CPL3 coverage alongside all existing native allocation/release/idle assertions. Update actual consumers and their tests, the native policy, component architecture/roadmaps and the manual. Run warning-denied formatting, strict Clippy, unit and native tests, full manual checks and original CI; retain all pre-existing full lifecycle/frame/Pagerd/toolchain/guest-build acceptance gates. This design earns no completed acceptance leaf.

Owning coordination: Kernel lifetime design, Kernel WIP PR, Integration WIP PR and phase completion.

Explicit grant implementation progress — 20 September 2026:

Kernel commit 4a5333f760e258ebca23047a362d1cff4fded0c0 is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending.

Integration commit 9166f7bde6a0b42afd3ef1c9898b9e818df9af86 is a signed orchestration-library dependency checkpoint. Four strict 320/321-unit configurations and four native library builds pass without warnings. Original CI 1693/1694 is waiting at its first observation. The full image catalogs still retain their preceding coordinated selection until actual consumers are validated together.

Shared wire and dependency checkpoints, each with strict matrices and original CI passing: lib-ipc issue/PR, lib-capabi issue/PR, lib-bootstrap issue/PR, lib-interrupt issue/PR, lib-service issue/PR, lib-time issue/PR, lib-block issue/PR, lib-log issue/PR, lib-driver issue/PR, lib-vfs issue/PR. Their linked WIP PRs retain the detailed signed revisions and validation.

The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. Deviced bug 4 records a separately observed quarantine test race and its test-only serialization correction.

This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required.

Verified grant-rights checkpoint — 20 September 2026:

Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.

All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. Rootd baseline regression and Deviced quarantine fixture race are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress.

Integration bug 68 records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis.

Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required.

Manual and dependency validation — 20 September 2026:

Docs commit f4621ce2921b2b9fe3b1d25b4321d6b28289418e is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass.

Thirty-one additional downstream consumers now have signed dependency-alignment checkpoints, each with four strict unit configurations, four native builds, host/native Clippy, formatting and private rustdoc passing without warnings. All 62 original CI runs pass. Their owning feature issues and WIP PRs retain exact revisions and log evidence. Catalog regression 68 remains open until the remaining Exsh selection and complete original catalog are validated together. Individual repository success is not full service-image acceptance.

Exsh's default development tests pass 976 units. Aggregate release-test compilation and a subsequent explicitly separated library compilation each reached the local unchanged 120-second silence limit before tests ran; both failures remain retained. No release-test success is inferred, no compiler setting or deadline was relaxed, and independent configurations are being collected without rerunning failed commands unchanged. The complete source/effect/frame gate also remains open.

Original Integration 1693/1694 also fails with 127 manifest/catalog mismatches each, before full VM execution. Six complete logs total 604,756 bytes, with no warning candidates. Together with 1683–1692 this is twelve retained original failing runs. Earlier full-VM filesystem timeouts remain separately tracked in ext-family issue 20 and FAT32 issue 58.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open.

Complete original catalog checkpoint — 20 September 2026:

Integration f9681efc30f1c48989def7f0e7db939974a30e27 is signed and pushed in WIP PR 12. Both complete catalogs now pass exact dependency equality against 73/70 clean original selected checkouts and 72/71 manifests; all 143 selected signatures verify. The original Integration library pin is retained independently of the catalog commit, avoiding a circular source reference. Twenty dependency-policy and 46 immutable-source tests, both native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Corrected-source original CI 1695/1696 is running; bug 68 remains open pending that observation and full consumer acceptance remains separate.

The executed inputs for both first-attempt native VM passes remain exact: 27 new ordinary CPL3 grant-right controls, every earlier lifetime/owned-invocation assertion, original 60-second bounds, zero build warnings and empty QEMU stderr. Both packaged kernels match retained original artifacts and all fifteen original source signatures verify. The final post-VM changes only select the full catalogs and reconcile documentation.

All 31 further fully validated consumer checkpoints pass four strict unit/native configurations and all 62 original CI runs; 124 complete logs total 3,041,213 bytes with no warning candidates. Their owning feature issues and WIP PRs preserve exact source and CI evidence. The full manual and regenerated IPC references are published in Docs WIP PR 4; its 45 tests, 2,429 pages, 448,913 word bounds and eleven changed-page reviews pass, as do original Docs CI 991/992 with zero final warnings.

Exsh dbc958bcdaa557a461e9308a31d23d3b8c189296 in WIP PR 3 is explicitly an incomplete-validation dependency checkpoint. Both development configurations pass 976 units, four native builds and strict Clippy/docs configurations pass, and all 355 checker tests pass. Three local release-unit compilation attempts reached the unchanged 120-second silence bound before tests ran. Four local frame checks return 1 with complete workspace mapping and 97/63 unresolved routes. Original CI 273/274 likewise passes 976 units and 355 checker tests, then fails the full frame/source gate with 101/68 unresolved observations. Four complete CI logs total 319,871 bytes with zero warning candidates. These local and CI artifacts are distinct; no frame or release-unit acceptance, relaxed deadline or unchanged retry is claimed.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. The full in-EriX builds and native external Rust/LLVM/runtime rebuild remain unproven. Full consumer lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate and profiler attribution remain required; no canonical leaf closes at this checkpoint.

Installer return-slot regression — 21 September 2026:

Both original corrected-catalog runs are now classified: 1695 passes 431/489 VM scenarios and 1696 passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch issue 68 is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in issue 20.

Procd bug 4 records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce in WIP PR 2 derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open.

Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required.

Verified managed installer recovery — 21 September 2026:

Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.

Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.

The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.

The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.

Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.

Acknowledged terminal accounting — 21 September 2026: Kernel design 20 specifies final scalar CPU evidence retained independently of native resource reclamation, repeatable observations bound to actual original observer generations, independent authorized observers, exact acknowledgement and claim release on observer death. Both ordinary and mediator consumers must commit terminal measurements and cleanup duties before acknowledgement, including consumer-loss handling.

Shared wire commit 0b889095fd04f6f4b1da1d4c0064150551f52122 is signed and pushed. Four wire configurations pass 427 tests each; four syscall-shim configurations pass 20 each with one existing ignore. Eight native builds, strict host/native Clippy, formatting, private rustdoc, Markdown and dependency checks pass without warnings. Native kernel and consumer adoption, actual CPL3/service VM acceptance and original CI observation remain open.

Canonical completion remains 3.48% weighted; 15 of 460 acceptance items. Full upstream Rust/LLVM/runtime rebuilding inside EriX remains mandatory together with both full EriX guest build generations. No acceptance item closes from this representation checkpoint.

Verified native terminal accounting — 21 September 2026: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7 is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback.

Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings.

Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9); owned invocation retains 1,587 (SHA256 404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify.

Kernel regression 21 retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred.

Integration fcd7b4a9608f629a12de78c53da5c3615d906b46 is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation.

Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under Kernel design 20. Canonical acceptance remains 3.48% weighted; 15 of 460 items. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.

Committed terminal-accounting consumers — 21 September 2026:

Procd 66934642c4464fc738152a9e60790914ba27dd1c in WIP PR 2 reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI 298/299 passes from four complete hashed logs, 347,245 bytes, zero warnings. Bug 5 remains open for actual service acceptance.

Rootd 64c97b13c450003d9c2b6bd9ed2a627088684b46 in WIP PR 2 acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed bug 7: a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI 1041/1042 passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates.

Docs e4525848ad4462901c9a6794ef1794cf85ea9e6b updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI 995/996 and corrected-table 997/998 passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved.

The separate Integration orchestration library checkpoint b06dfad00202765491a64552dde29eaca1c24838 passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance.

No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure.

Twelve shared dependency libraries pass all four strict host/native configurations and 24 original CI runs, with 48 complete verified logs totaling 620,122 bytes and zero warnings. Owning issues and WIP PRs are synchronized. The signed original checkpoints are:

Component tracking	Revision	Passing original CI
lib-bootstrap issue / PR	8110627a6723	157/158
lib-block issue / PR	40fcbe0d568c	47/48
lib-interrupt issue / PR	09a9de168bd8	60/61
lib-log issue / PR	1b4e0dda15d5	67/68
lib-service issue / PR	9b280b903277	85/86
lib-time issue / PR	cdf323ee1804	55/56
lib-driver issue / PR	d509b04b346b	31/32
lib-input issue / PR	d0997ac4a4ad	30/31
lib-posixabi issue / PR	d5616f1fccc4	15/16
lib-stdio issue / PR	78f31a4cecc7	19/20
lib-tty issue / PR	a42c108c2030	16/17
lib-vfs issue / PR	8d4c6299e0d3	37/38

Coherent terminal service adoption — 21 September 2026:

All 35 application/service dependency checkpoints are signed and pushed. Thirty-four pass every maintained local strict configuration, normally four and additionally eight for Deviced and twenty for Logd; Exsh retains explicit incomplete gates below. E2fsd passes four 264-test selections with original explicit fixture tools; RTC passes each actual ELF stack-layout gate. Thirty-three services now have both original CI runs accepted: 66 runs, 2,879,508 complete hashed log bytes, zero warnings. Owning issues and WIP PRs are synchronized. Logd's original 239 passes; 240 has failed and both terminal log requests return HTTP 500. Cause and warning classification remain unresolved; no unchanged run was restarted.

Both full catalogs pass original manifest/catalog equality against clean, signature-verified checkouts, selecting the original terminal observation, exact acknowledgement and final CPU graph. Signed Integration dff878dd3545 in WIP PR 12 publishes both coherent catalogs. All 169 helper commands pass with retained original source/socket setup refusals and the quiet-fixture timeout. The previously maintained traced disk invocation passes in 258.975743 seconds under unchanged 600/120 bounds; a fresh owned short path passes all 14 socket controls without relaxing the platform limit. The orchestration Rust inputs retain four strict 320/321-test configurations. Actual shell times, two-CPU Extop and out-of-session denial VMs pass under unchanged 120-second guest limits, with warning-free builds, empty QEMU stderr and all marker controls. Extop CPU percentages remain unavailable; numeric utilization and complete mediator lifetime are unproven. The ordinary startup image builds, but preflight rejects it before boot: bug 69 tracks the transition-feature and Kernel metadata gaps. Source admission, capture bounds and thresholds remain enforced. Original 1703/1704 is monitored separately. A local helper initially refused a stale native memory-support checkout; its original failure is retained and the already verified original checkout is now explicitly selected, without weakening source checks.

• VFS audit / WIP PR 3: signed 378181a5840f removes ambient disassembler selection and inherited child environment. All 21 controls and both actual 167,632-byte runtime/smoke frame checks pass under the unchanged ceiling. Original 90/91 passes from 158,176 complete log bytes with zero warnings. The whole-program proof remains separate.
• Exsh audit / WIP PR 3: signed 0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed passes two 976-test development selections, four strict native/Clippy/private-rustdoc selections and 355 controls. Both release unit compilations stop at the unchanged silence deadline (126.117857/120.024146 seconds, clean owned cleanup) in compiler regression 9. Actual runtime/all-feature frame reports remain incomplete with 97/63 unresolved routes in each deployment profile; frame regression 4 remains open. Original 275/276 fails the required full-frame gate after 976 unit tests and 355 controls pass; four complete logs total 319,902 bytes with zero warnings. CI artifacts have 101/68 unresolved observations, separately from local 97/63. The corrected tool intake reaches actual analysis; tool-selection issue 5 is closed, while frame and release-compiler gates remain open.
• Docs / WIP PR 4: signed f8a40d45fbbd passes 45 tests, all 2,431 manual pages and 449,997 rendered word bounds, plus visual review with zero final warnings. Original 999/1000 passes from 774,750 complete hashed log bytes; all 45 tests and 2,431 manual pages pass with zero final warnings. Early reference-convergence warnings remain retained.
• Procd consumer regression 5 / WIP PR 2: selector documentation at 68748bc65ea3fb798e810d624845dcb298ae1346 passes original 300/301 with unchanged validated runtime bytes. Ordinary metrics consumer loss/restart and final reply disposition remain open. Failed metrics transport stops Procd; continued row reuse after that failure is not established.

The repeated static audit covers 3,164 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and all 92 conventional crate roots. These declarations and size checks do not establish semantic authority closure for every repository.

Original Integration 1697/1698 retains 488/489 and 487/489 VM passes, passing Rust/Markdown and 28,115,674 complete log bytes without warnings. Both retain ext4 quota's original timeout in issue 18; 1698 additionally retains ext3 links in issue 20. Original 1699/1700 remains running and 1701/1702 waiting in the latest bounded observation. The newer acknowledged accounting graph still needs its own full service VM evidence.

Acceptance stays 3.48% weighted; 15/460 items. Actual service CPU/profiler VMs, ordinary and mediator lifetime, complete authority/source/effect/frame and Pagerd gates, native external Rust/LLVM/runtime rebuilding, and both complete EriX guest build generations remain mandatory and unproven.

Actual service CPU scenarios and startup admission — 21 September 2026:

The published original Integration catalog dff878dd3545c4751b3c05d37b2bdd5e21cce548 passes the maintained shell times, two-CPU Extop and out-of-session denial VM scenarios under their unchanged 120-second guest limits. Each retains 106 hashed evidence files, warning-free image builds, empty QEMU stderr and every required, forbidden, ordered and unique marker check. Build-plus-scenario wall times are 119.876978, 34.802620 and 36.173027 seconds respectively; these are not guest-only or startup measurements.

Times reports nonzero self and waited-child CPU. Extop observes both CPUs, memory and increasing job CPU nanoseconds with CTRL no; both per-CPU percentages remain --.--% in the two samples, so numeric utilization is unproven. The denial scenario confirms the existing out-of-session boundary. Complete mediator/lifecycle acceptance in Procd 5 remains open.

A separate ordinary development package also builds without warnings, but its required startup-contract preflight exits 1 before any VM or observer starts. Integration 69 records the missing full-runtime-transition contract selections and Kernel effective-feature/original-source evidence. Preserve the refused package and all admission controls; the 120/15/10 capture limits and performance thresholds are unchanged. No startup-profile acceptance is awarded. Complete source/effect/frame and Pagerd proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required by Phase 6 completion.

Original full-regression observation — 21 September 2026:

Original Integration 1699/1700, source fcd7b4a9608f629a12de78c53da5c3615d906b46, each finish at 487/489 VM passes. All six complete logs retain 28,483,276 bytes with zero warning candidates; Rust and Markdown jobs pass. The original worker boundaries identify quota's 120-second timeout in 1699 and 45-second serial stall in 1700, ext4 links' 120-second timeout in 1700, and FAT32 directory metadata's 120-second timeout in 1699. The latter has a distinct canonical bug report. Existing quota 18 and links 20 remain open. No shared root cause is inferred, and no unchanged rerun, cancellation or threshold relaxation is requested.

Signed startup source/feature correction — 21 September 2026:

Integration fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure.

All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; bug 71 retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices.

The technical manual update 76672dff8ff83 passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs 1001/1002 passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow.

A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under bug 69; no threshold or 120/15/10 capture limit changes. Original Integration 1705/1706 is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory.

Actual original-source startup capture — 21 September 2026:

Signed Integration fd8a5cf0dbcf builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance.

The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. The new canonical timing bug retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented.

The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded.

Current observation checkpoint — 21 September 2026: signed 9c62af2d2484 records the actual startup outcome in the roadmap; executable and library inputs remain identical to the measured fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa implementation. Markdown, template structure and source policy pass. Original Integration 1701/1702 remains running; 1703–1708 remains queued. Logd 239 passes; 240 has failed, with both terminal log endpoints still returning HTTP 500. Its cause and warning classification remain unresolved. Original runs are preserved without restart or cancellation. All 3,165 authored code files remain below 1,000 lines; the static pin and missing-docs declaration checks remain intact. Full authority/source/effect/frame, startup performance and native external-toolchain/EriX guest-build acceptance remain open.

Coherent scalar-consumer validation — 21 September 2026: signed Integration 07c883525ee5 selects Procd 59ee30a88534 in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven.

Procd's four strict 308/314-test configurations and original CI 302/303 pass. The manual update passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines.

Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven.

Executed-code profiling checkpoint — 22 September 2026: signed Integration 4fa27f942bc2, tracked in Integration PR 12, adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The operator guide distinguishes complete counters from VM acceptance.

One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. Profiler acceptance and startup performance remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors.

The signed manual update, tracked in Docs PR 4, passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven.

Owned address-space preparation — 22 September 2026: Kernel issue 22 records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed Kernel 5e818e8b6d1d, in Kernel PR 3, adds the design contract and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization.

Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in Integration 3 and Integration 72. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven.

Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.

Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.

The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad002 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.

All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.

Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.

Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Verified documentation and CI follow-up — 22 September 2026: Kernel documentation and Integration documentation record the accepted native mapping, three-grant cleanup and ordinary exec-successor evidence. Every executable file is identical to the tested implementation; Markdown and diff checks pass. All three failed fixture attempts remain in report 24, separately from the fixed admission defect. The complete manual passes 45 tests and 2,431 pages with no final warnings. The final static inventory covers 3,180 authored code files below 1,000 lines, 259 exact Git pins and the existing direct missing_docs declarations; it does not establish full semantic authority closure.

Original full Integration 1703/1704, source dff878dd35, pass from six complete logs totalling 26,964,178 bytes and zero warnings. Their ext4 quota/links and FAT32 directory scenarios explicitly pass. Earlier timing failures remain retained and their causes are unestablished. Kernel 634/635 report cancelled, with runner context-cancellation messages and four complete logs. No cancellation request was issued during this work; the workflow declares no cancellation policy, and the initiating cause remains unestablished. These runs receive no CI acceptance credit. Current Kernel 636/637 and Docs 1007/1008 pass. Each pair has four complete logs: Kernel totals 773,796 bytes with zero warnings, and Docs totals 774,706 bytes with zero final warnings. Both manual builds retain their initial 35/1/0 LaTeX warning sequence through convergence. Integration 1717–1720 remains queued.

The phase checklist remains at 15/460 accepted leaves, weighted 3.48%. Private hardware roots, complete authority cleanup, measured startup improvement, native external Rust/LLVM/runtime rebuilding and both complete EriX guest-build generations remain open.

VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.

The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.

Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.

Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Ordinary protection contract — 22 September 2026: the runtime memory design now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory.

Older VM regression observation — 22 September 2026: the ext4 deadline report preserves original Integration CI 1705/1706 at fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa. The complete 489-scenario catalog reports 482/7 and 485/4 pass/fail outcomes; eleven actual 120-second QEMU timeouts cover eight distinct ext4 scenarios. Rust 320/321-test configurations and Markdown pass. All six complete original logs are retained without warning candidates. Root cause, isolated reproduction and correction remain open; no rerun or relaxed limit supplies acceptance. External toolchain rebuilding and both complete EriX guest-build generations remain required.

Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.

The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.

Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.

Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

VSpace ownership preparation — 22 September 2026:

Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.

Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.

The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).

Native occupancy diagnostic regression — 22 September 2026: the original failure is retained with exact signed source and packaged-ELF identity. The fixture maps a Kernel heap VA that the correct ordinary-domain guard rejects on the native upper-half heap. Host allocator addresses did not expose the mismatch. The correction must preserve the guard, 64-page/alias/hole/byte/cleanup controls and both maintained VM deadlines. The report was subsequently resolved by the verified recovery below. No canonical acceptance leaf closes.

Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.

Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.

Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.

Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.

Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.

Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.

Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.

Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.

Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel 12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.

Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.

Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.

Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.

Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.

Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

## Problem and motivation Phase 6 needs one public completion record spanning POSIX compatibility, authority confinement, the complete guest build pipeline and the supplementary interface, signing and documentation requirements. Individual implementation issues and PRs retain their detailed contracts and evidence; this issue tracks the complete outcome. ## Proposed behavior and scope An EriX machine must build the entire declared EriX product graph from source, including every authored component, native build helper, generated document, signed boot artifact and complete bootable disk image. Boot an image produced by that build and perform a second complete build inside it. Both generations require exact source/tool/image identities, empty product output trees, complete logs, reproducibility checks and matching runtime tests. The extended-image compiler must be built from selected upstream Rust/LLVM sources for execution on EriX, with EriX libc/sysroot integration, Rust standard-library OS bindings, LLVM code-generation libraries and the required C/C++ runtime closure. The initial EriX-hosted toolchain may be cross-built on Linux, then must execute and pass functional and authority-negative tests inside EriX. A Linux binary or target specification alone is insufficient. The extended development image must also rebuild the selected upstream Rust/LLVM toolchain and runtime closure inside EriX using its supplied offline sources, recipes, dependencies and explicit bootstrap compiler. Require no unrecorded porting changes or host build assistance; validate the guest-built tools and use the rebuilt compiler for at least one complete EriX build. Cross-compilation alone is not native rebuild evidence. The booted OS, firmware and compiler execution substrate must be inventoried separately from rebuilt product outputs. No cached EriX product object, hidden host build step or host-side repair/assembly may fill a missing guest output. The host may record, verify, export and boot completed artifacts through explicit paths. The checklist includes real serial/PS2 CLI testing; native boot/hash tools with Linux support; help and manual pages; custom-key UEFI Secure Boot and signed rootfs authority; protected CI download signing; non-authoritative unsigned preferences; keyboard layouts; independent consoles, framebuffer clearing, vttys, TUI/extop, mouse selection/paste and the optional boot logo. ## Authority, security and reliability Priority is security, then reliability, then performance. Every capability needs an explicit source, recipient, object, rights, delegation limit, lifetime and retirement rule. Names, paths, IDs, uid 0 and environment text cannot grant authority. Preserve exact caller/process/receiver generations, least-authority source/output/tmp/tool roots, independent cleanup obligations and fail-closed handling of uncertain retirement. Full source/effect/frame and existing VM admission gates remain mandatory. Audit the entire maintained codebase continuously; remove ambient, residual and unwanted explicit authority, deprecated APIs, obsolete migration paths and redundant code. Keep authored code below 1,000 physical lines through thematic refactoring. Document public and private invariants inline with rustdoc and enforce missing_docs in every crate. Profile bounded real workloads before claiming or implementing performance improvements; never trade away security, correctness, durability or fairness for speed. Work on `feature/posix-compat`, preserve user changes and signed history, and push reviewable signed commits regularly using the canonical tagged-header/blank-line/body format. Pin cross-repository dependencies and CI helpers to full original commit hashes. Keep shared governance/templates identical to meta; update README/ARCHITECTURE/ROADMAP in their canonical formats and relevant manual TeX/API references. Use canonical feature_request, bug_report and PR templates with phase-6 and applicable topic labels. Keep credentials, sensitive evidence and suspected vulnerability details in their authorized private channels. ## Acceptance criteria **Completion: 3.48% weighted acceptance; 15 of 460 individual items accepted.** Reconciled 21 September 2026. The unweighted fraction is 3.26%. These measures count completed deliverables, not effort or elapsed time. Partial implementation earns no whole-item credit. Each section contributes its fixed weight multiplied by its completed-item fraction; repository audit rows count individually. A rounded percentage never substitutes for the final build and regression gates. The native Rust/LLVM rebuild gate added on 19 September 2026 increases the denominator from 459 to 460. The toolchain section has no accepted items, so weighted acceptance remains 3.48%; no completion credit was added. Checking an item requires its complete deliverable and evidence at the selected original revision. Failed, skipped, cancelled, incomplete, warning-bearing or predecessor-only checks cannot establish acceptance. Implementation needs meaningful positive, malformed-input, authority-negative, interruption and cleanup tests, strict local checks, actual bounded VM coverage where relevant, and original CI observation. Preserve failures and unknown causes. Both full builds inside EriX remain unproven. ### Phase 5 handoff and remaining gates Weight: 2%; accepted: 2/10. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/6) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Preserve the archived tracker and an evidence index for the exact source graphs, CI logs, main-image hashes, rejected experiments and all failed timing observations; distinguish historical results from current-head gates. - [x] Observe CI 1549 to terminal status, audit every job/log and full scenario/post-image count, and classify remaining failures without weakening markers, source identity, worker ownership or deadlines. - [x] Review the held `10d57e98` checkpoint and record its disposition: preserve its signed ancestry when creating `feature/posix-compat`; publish a coherent new-branch graph only after the predecessor evidence is retained. Do not drop the locally committed pin or silently substitute an older graph. - [ ] Run the carried checkpoint's own exact-head full CI and a fresh repository-wide CI inventory; resolve any failures/warnings at their owners. - [ ] Revalidate the prepared direct-chunk private-image recipe against the chosen Phase 6 base before reuse; bind all source revisions, environments, cache keys, executable PT_LOAD bytes and rootd path/capacity differences. - [ ] Build/audit matching private dev/release images once admitted; retain original helper failures and the narrow proven locale-receipt handling. Do not reuse a predecessor's symbol addresses or compiled-object attribution. - [ ] Collect one adjacent audited control and two complete candidate startup observations, with no concurrent local VM/compiler, using unchanged 120 s total / 15 s silence / 10 s command collection limits. - [ ] Close the carried startup acceptance only after **both** candidate observations satisfy root-to-final-READY ≤5 s, largest service-ready gap ≤1 s, final-READY-to-full-editor-caret ≤1 s, and the exact four-command interval ≤2 s. Preserve the maintained oracle and command; never retry unchanged input to green. - [ ] Record remaining bottlenecks as [Integration profiler and measured optimization](https://git.erikinkinen.fi/erix/integration/issues/3) findings if [Phase 5 handoff and remaining gates](https://git.erikinkinen.fi/erix/integration/issues/6) fails; validate each eventual fix with strict component checks and matching VMs. - [ ] Update the carried acceptance report and component/manual status with actual results; retain all six old unchecked rows as covered by these items rather than counting duplicate validation prose as six independent gates. ### Scope, repository and build inventory Weight: 3%; accepted: 3/16. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/1) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Inventory all existing repositories, nested Cargo workspaces and crates, targets, profiles, feature combinations, scripts and maintained tests. Record repository paths, remotes, exact heads, dirty state and build ownership. - [x] Record/create `feature/posix-compat` before each repository's first edit; verify exact dependency pins and signed ancestry from the accepted base. - [x] Verify whether `lib-posixabi`, `lib-cstd` and `posixd` already exist remotely; create each missing required repository in Forgejo from `meta` before cloning. - [ ] Scaffold those three components with explicit responsibility and authority boundaries, rustdoc, strict CI, tests and specialized canonical docs. Keep import recipes/profiler in Integration; do not invent extra daemons/repos without a concrete ownership need and recorded design review. - [ ] Add new components to Integration's commit-pinned catalogs and immutable dependency policy; validate the exact transitive source graph. - [ ] Freeze a machine-readable full-build output inventory: every maintained EriX crate/library/binary, kernel, EFI bootloader, native build tools, boot image, dynamic/launch metadata, four image profiles and release manifests. - [ ] Inventory all canonical generators, documentation/manual outputs, checksums/compression/signing steps and their host executables. Include these in the in-EriX build closure; distinguish external test execution from building. - [ ] Record the build-host versus emitted-target matrix: EriX-hosted tools and compatibility libraries for `x86_64-unknown-erix`, plus the existing bare-metal and UEFI targets needed to rebuild the OS. Do not rewrite native target ABIs merely to make imported tools run. - [ ] Produce an API/workload matrix from the exact intended Rust/LLVM, Cargo, Python, Git, shell, image and documentation recipes; map every required call/ELF feature to an owner, implementation item and independent test. - [ ] Define the POSIX specification edition/profile, C ABI/data model, locale baseline and optional extensions. Mark unsupported optional surfaces explicitly; never claim full POSIX certification from a selected build workload. - [ ] Resolve/document the existing Phase 6 close-on-exec-by-default policy versus standard descriptor inheritance expectations. Preserve native authority ceilings; specify any compatibility deviation before implementation. - [ ] Approve the architecture/threat model for `posixd` isolation, process mediation, TLS, fork snapshotting, signal delivery and build realms. Enumerate trusted components and keep POSIX policy out of the kernel/rootd. - [ ] Fix per-scenario resource budgets and progress/deadline contracts from measured workloads; distinguish ABI/hardware bounds, authorized quotas and accidental hard-coded limitations. - [ ] Define exact self-host success/failure criteria and evidence schema before implementation: source-only inputs, no host build delegation, two clean in-EriX builds, deterministic artifacts, boot result and authority-negative tests. - [ ] Extend inventories with rootfs authority-bearing files/signatures, firmware trust enrollment, native build-tool targets, man/help coverage and console/input interfaces; assign each an owning public issue and acceptance test. - [x] Record `v1.0.0-alpha.1` as the intended manually reviewed release baseline, coordinating platform/component version policy without premature version bumps, tags, PR readiness or release publication. ### Whole-codebase authority and quality audit Weight: 8%; accepted: 1/102. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/2) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Create an audit register keyed by stable finding ID, repository, file/symbol, category, severity, exact revision, invariant, reproduction, remediation owner, regression test, status and closure evidence. - [ ] Inventory every startup/runtime capability: origin, receiving principal, object, operations, delegation ceiling, lifetime and all aliases. Include boot handoff, service registration, compatibility realms and tools. - [ ] Find ambient authority from global selectors, default service discovery, cwd/PATH/env, numeric slots/PIDs, implicit devices, inherited routes, host filesystem fallbacks and cache metadata; replace it with explicit grants. - [ ] Find residual authority after success, error, cancellation, interruption, timeout, restart, failed reply/transfer, fork, exec and teardown. Prove every alias is retired or its necessary retention is documented. - [ ] Find unwanted explicit authority: oversized startup inventories, broad provider/admin endpoints, duplicate aliases, unnecessary read/write/exec rights and debug routes. Attenuate/remove it even when technically explicit. - [ ] Audit generation reuse, replay, stale pending replies, confused deputy paths, endpoint impersonation and TOCTOU around path/object resolution. Test forged descriptive identity without the corresponding capability. - [ ] Audit cleanup failure behavior: attempt independent retirements, preserve existing caller-specific error precedence, including cleanup uncertainty overriding the triggering error, and quarantine/terminate when required; never continue serving with an unaccounted grant. - [ ] Audit unsafe code, FFI, wire parsing, range arithmetic, initialization, lifetimes, locks, interruption and publication order; give each unsafe block an exact safety argument and adversarial test where practical. - [ ] Inventory redundant implementations, dead/fallback code, duplicated validators, obsolete wrappers and deprecated public/wire APIs with all callers. - [ ] Migrate callers and remove deprecated APIs/compatibility shims in coordinated signed graphs; test rejection of retired versions without silent permissive fallback. Do not retain an obsolete API solely to avoid caller edits. - [ ] Classify every hard-coded size/count/depth/time restriction as ABI, hardware, explicit resource policy or accidental implementation limit. Replace accidental limits with checked caller-sized storage or authorized allocation. - [ ] Test above every removed old boundary and at exact allocation/ABI boundaries; preserve resource exhaustion errors, denial-of-service protection and mandatory bounded waits instead of interpreting “no arbitrary limits” as “unlimited resources”. - [x] Inventory all authored code files at/over 1,000 physical lines, including tests, scripts and generated-source templates. Refactor them into cohesive modules below 1,000 lines, preserving meaningful APIs and tests. - [ ] Add a deterministic tracked-source size gate; exclude only genuine non-code data/external payload archives, not large authored tests or fixtures containing executable logic. Split generators and their generated code too. - [ ] Audit production versus integration/dev-only feature gating and linked symbols. Move/delete remaining test orchestration/diagnostics from production rootd; carry every retained move/delete classification to closure. - [ ] Re-measure rootd semantic surface using the maintained baseline tooling; compare same-toolchain code size, imports, unsafe blocks, accepted messages and authority inventory, not incomparable historical LoC estimates. - [ ] Audit bootstrap service ownership and release/development authority parity; prevent new compatibility work from adding policy or routine test orchestration back into rootd. `initd`/bootd-style work stays Phase 7.3. - [ ] Audit all performance findings through [Integration profiler and measured optimization](https://git.erikinkinen.fi/erix/integration/issues/3) evidence before changing algorithms; deduplicate measured hot paths without caching successful access checks, broadening grants or leaving invalidatable state unowned. - [ ] Audit build/CI scripts for secret exposure, mutable shared outputs, symlink escapes, unsafe deletion, unbounded subprocesses, silent warning suppression and accidental host dependencies. - [ ] Repeat the entire audit on final heads, independently review all security closures, and require zero unresolved in-scope authority, deprecated API, undocumented-code and over-1k-code findings before Phase 6 acceptance. - [ ] Inventory obsolete planning/migration documents, manifests, scripts, CI jobs, feature flags and migration-only tests, including dynlink migration checks and the superseded local planning archive. Preserve necessary evidence in historical artifacts/issues, then delete obsolete active files and references; retain current specifications and security assertions, not obsolete scaffolding. - [ ] Remove superseded static executable intake from every public launch, loader, policy, configuration and test path now replaced by dynlink intake. Map each former useful assertion to maintained coverage, reject retired input, and preserve genuinely required mount/bootstrap mechanisms with explicit scope. Inspect real consumers: a shared segment type used by dynamic materialization or the EFI loader's pre-runtime boot contract is not removed by name alone. - [ ] Audit symbols, filenames, flags, wire names and diagnostic tokens for milestone terminology; replace planning-based naming with semantic responsibility names and update all consumers/tests atomically. Allow useful historical comments/docs and real algorithmic concepts, not executable planning APIs hidden behind an exception. - [ ] Review code navigation, naming, control flow, error paths, module cohesion and inline explanations with a contributor/auditor walkthrough; merge semantically similar files where useful while staying below 1,000 lines. - [ ] Identify repeated behavior across repositories suitable for an authority-free shared library; document genuine common semantics, variation, dependencies and boundaries before extracting it. Do not abstract merely similar syntax or combine unrelated trust domains. - [ ] For each justified extraction, create a new Forgejo repository from `meta` first, clone/branch it, implement documented/tested shared APIs, migrate callers, remove duplicates, and add catalog/CI/manual/man-page/audit/PR entries. Add explicit checklist rows for every resulting repository and use exact dependency commit pins without circular service/library dependencies. - [ ] Complete the authority, lifecycle, quality and documentation audit for `blockd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/blockd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `boot-tool`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/boot-tool/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `bootloader`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/bootloader/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `coreutils`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/coreutils/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `crashd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/crashd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `deviced`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/deviced/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `docs`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/docs/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-acpi`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-acpi/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-i8042`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-i8042/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-ps2-keyboard`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-ps2-keyboard/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-ps2-mouse`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-ps2-mouse/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-rtc-cmos`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-rtc-cmos/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-serial`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-serial/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `drv-virtio-block`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/drv-virtio-block/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `dynlinkd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/dynlinkd/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `e2fsd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/e2fsd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `exsh`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/exsh/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `extop`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/extop/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `fatd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/fatd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `fbcond`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/fbcond/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `hotplugd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/hotplugd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `inputd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/inputd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `integration`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/integration/issues/11). - [ ] Complete the authority, lifecycle, quality and documentation audit for `irqd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/irqd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `kernel`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/kernel/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `keyd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/keyd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `launchd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/launchd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-aes`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-aes/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-block`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-block/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-bootimg`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-bootimg/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-bootstrap`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-bootstrap/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-capabi`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-capabi/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-cli`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-cli/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-console`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-console/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-constant-time`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-constant-time/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-crc`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-crc/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-deflate`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-deflate/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-device`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-device/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-driver`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-driver/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-dynlink`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-dynlink/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-ed25519`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-ed25519/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-elf`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-elf/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-fs-crypto`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-fs-crypto/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-fs-name`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-fs-name/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-handoff`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-handoff/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-input`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-input/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-interrupt`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-interrupt/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-ipc`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-ipc/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-log`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-log/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-partition`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-partition/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-service`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-service/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-sha2`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-sha2/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-stdio`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-stdio/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-time`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-time/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-tty`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-tty/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-vfs`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-vfs/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `loaderd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/loaderd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `logd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/logd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `memd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/memd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `meta`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/meta/issues/3). - [ ] Complete the authority, lifecycle, quality and documentation audit for `named`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/named/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `pagerd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/pagerd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `powerboxd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/powerboxd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `probed`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/probed/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `procd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/procd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `ramfsd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/ramfsd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `rootd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/rootd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `seriald`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/seriald/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `sha2-tool`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/sha2-tool/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `timed`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/timed/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `ttyd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/ttyd/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `vfsd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/vfsd/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `vspaced`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/vspaced/issues/1). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-posixabi`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-posixabi/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `lib-cstd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/lib-cstd/issues/2). - [ ] Complete the authority, lifecycle, quality and documentation audit for `posixd`, including required tests and original CI; justify non-applicability per dimension. [Repository audit](https://git.erikinkinen.fi/erix/posixd/issues/4). ### Rustdoc, missing_docs and documentation Weight: 5%; accepted: 2/15. [Owning issue](https://git.erikinkinen.fi/erix/docs/issues/1) · [docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). - [x] Inventory every crate root and target, including binary-only, build-script, test/example and nested crates; identify existing missing_docs enforcement and every local allow/expect/doc-hidden escape. - [ ] Document crate/module purpose, trust boundary, owned/borrowed state, lifecycle, authority and error contracts using `//!`/`///` rustdoc comments. - [ ] Document every public item, field, variant, constant, associated item, macro and FFI export with semantics, units, ranges and failure behavior. - [ ] Document private functions, structures, fields and non-obvious algorithms as well; explain concurrency, mutation order, cleanup, complexity and invariants. `missing_docs` alone is not a private-code completeness audit. - [ ] Give unsafe APIs `# Safety`, and fallible/panicking APIs accurate `# Errors`/`# Panics` sections where applicable. Document each unsafe block's concrete invariant and why safe alternatives do not cover the operation. - [ ] Enforce `#![deny(missing_docs)]` or an equally non-bypassable shared lint policy in every EriX-authored crate/target; reject weakening attributes. Do not use blanket allowances, dummy comments or doc-hidden to pass the gate. - [ ] Add private-item documentation review/check coverage and run Rustdoc with `--document-private-items`; validate broken links and examples with `RUSTDOCFLAGS="-D warnings"` across supported target/feature profiles. - [ ] Ensure CI actually checks missing_docs in default and alternate feature builds, not only one public-library configuration; add a negative fixture proving undocumented public API fails the shared policy check. - [ ] Document non-Rust authored code inline in its language's supported comment format, including shell/Python tools and assembly boundary contracts. Do not pretend rustdoc parses unrelated languages. - [x] Update `meta` standards/templates and propagate necessary policy changes deliberately. Repair stale canonical GenAI policy links to `docs/policies/generative-ai-contributions.md`; keep attribution optional. - [ ] Update README/ARCHITECTURE/ROADMAP and relevant manual chapters for each implemented ABI, realm, POSIX service, toolchain, profiler and build step; keep historical measurements separate from current guarantees. - [ ] Regenerate API references, test examples, build the whole manual, check final warnings/overflow/links and visually inspect changed rendered pages. Record toolchain/source provenance for the generated documentation. - [ ] Update canonical templates and every repository README to remove current-status/progress/checkpoint sections; put concise current state in ROADMAP/ARCHITECTURE and detailed historical evidence in linked issue/reports. - [ ] Refactor long README/ARCHITECTURE/ROADMAP paragraphs and exhaustive lists into short summaries plus focused design/API/operator documents. Preserve canonical headings, discoverability and normative invariants; do not hide important authority limitations or move status into another README section. - [ ] Keep help text, man pages, rustdoc, C headers, IPC specifications and technical manual consistent through shared semantic metadata where useful; validate coverage and examples, not merely that generated files exist. ### Integration profiler and measured optimization Weight: 5%; accepted: 2/19. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/3) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Inventory existing READY/command timers and private QMP/PC evidence; define which collectors are reusable, incomplete, obsolete or unsafe to retain. - [ ] Specify a versioned profile format with source/image/config hashes, toolchain, hardware/QEMU/acceleration/CPU/memory/worker settings, time domain, capture interval, exact process generation and module identity. - [ ] Define explicit capture authority, lifecycle and permitted fields; exclude key material, capability contents, consent input and arbitrary process memory. Diagnostics must not confer process control or namespace access. - [x] Add a bounded host collector with hard/silence limits, owned PID cleanup, interruption handling, raw-log preservation and true failure status. - [ ] Implement exact image/ELF/PT_LOAD/source binding and symbolization; reject stale maps and ambiguous userspace addresses without process/module identity. Do not infer process ownership from an overlapping virtual address. - [ ] Add authenticated, opt-in guest timing/counter hooks where host samples cannot attribute a cost; compile/runtime gate them appropriately and prove their absence from clean release images when disabled. - [ ] Record boot service stages: image resolution/read, relocation, mapping/materialization, process start, startup delivery, initialization, publication, cleanup, final READY and full shell-caret display. - [ ] Record command stages: Enter acceptance, parse/expand/resolve, authority request/decision, file reads, link/load, spawn/scheduling, first execution/output, output drain, exit/wait and fresh caret. - [ ] Measure IPC count/bytes/waits, runnable versus blocked time, context switches, mapping scans/batches, page allocation/faults, VFS/provider fanout, block request size/LBA, cache hits/misses and TTY/framebuffer work. - [x] Bound buffers through explicit resource policy, report dropped records, clock discontinuities and partial captures; never label incomplete data a complete profile or fabricate a percentage of total CPU time. - [ ] Implement reproducible reports: service timeline, command critical path, per-component counts, latency distributions and symbol/sample summaries. Separate wall time, CPU time, blocking time and sampling observations. - [ ] Add deterministic parser/attribution/error fixtures, malformed/stale identity tests, dropped-record tests and collector cancellation/timeout tests. - [ ] Add VM profiler tests that identify known synthetic CPU, wait and I/O workloads, reject cross-realm capture and verify all capture authority is retired. Compare profiled versus unprofiled overhead without subtracting it from acceptance measurements. - [ ] Establish controlled cold/warm startup and build baselines with isolated repeats, explicit resource limits and confidence/variance reporting. Preserve the stricter carried [Phase 5 handoff and remaining gates](https://git.erikinkinen.fi/erix/integration/issues/6) startup thresholds without moving endpoints. - [ ] Rank evidenced bottlenecks by measured end-to-end impact; create individual [Whole-codebase authority and quality audit](https://git.erikinkinen.fi/erix/integration/issues/2) findings with one causal hypothesis, owner and acceptance test. - [ ] Optimize the highest-impact proven path, then reprofile and repeat: inspect loader/provider fanout, mapping/process startup, event waits, build dependency scheduling and terminal delivery according to evidence, not guesses. - [ ] For each optimization, prove unchanged authorization, revocation, permissions, object identity, failure ordering, output semantics and fairness; retain strict tests and isolated same-configuration before/after measurements. - [ ] Add reviewed startup/build throughput and resource regression budgets to CI, using dedicated uncontended performance jobs and calibrated full-build deadlines. Ordinary functional jobs still have forced stall limits. - [ ] Remove superseded diagnostic hooks/helpers and document how to capture, interpret and reproduce profiles. Keep only evidence-backed tooling. ### POSIX ABI Weight: 3%; accepted: 1/9. [Owning issue](https://git.erikinkinen.fi/erix/lib-posixabi/issues/1) · [lib-posixabi PR 3](https://git.erikinkinen.fi/erix/lib-posixabi/pulls/3). - [ ] Define x86_64 C ABI sizes, signedness, alignment, byte order, calling conventions, structure layouts and ABI version negotiation. - [ ] Define errno values and a complete native-error mapping table, including missing authority, absence, unsupported operation, interruption, would-block, exhaustion, stale identity and partial I/O. - [x] Define fd/open-description, PID/process-generation, process-group, session, thread and realm identifiers as non-authoritative compatibility data. - [ ] Define file/status/mode/credential/ACL, seek/offset, directory, time, signal/action/set, wait and resource-limit types/constants. - [ ] Define IPC shapes with exact validation, request correlation, version/reserved-field rules and normalized capability transfer expectations; keep pure ABI parsing free of syscalls or service lookup. - [ ] Define checked 64-bit file/time arithmetic, C pointer/length handling, integer conversion and deterministic overflow/error behavior. - [ ] Provide reviewed C header declarations corresponding to Rust ABI definitions; test layout/constant agreement with independent C and Rust probes. - [ ] Test malformed/old versions, unknown flags, invalid identifiers, overflow, nonzero reserved fields, extra capabilities and noncanonical errors. - [ ] Publish documented ABI compatibility rules and pass strict crate, header, cross-target and exact-head CI gates before consumers depend on it. ### POSIX service and realm lifecycle Weight: 6%; accepted: 1/19. [Owning issue](https://git.erikinkinen.fi/erix/posixd/issues/1) · [posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5). - [x] Specify per-realm/per-process ownership and isolation inside `posixd`; separate private native service routes from each client's narrow authenticated ingress and reject numeric-realm impersonation. - [ ] Implement create/configure/seal/start/abort/retire realm states with generation-bound identities, validated resource ceilings and exact rollback. - [ ] Bind read-only source/toolchain roots, output/tmp roots, executable directories, cwd/root selectors and inherited streams from actual receipts. - [ ] Implement launch integration that creates a fresh compatibility process context, supplies only its selected routes, and never grants global `named`, provider, device, raw-block or kernel process-control endpoints. - [ ] Implement deny-only uid/gid/group/mode/ACL checks after native capability admission; test uid 0, chmod/chown-like metadata and executable permission changes cannot manufacture access or bypass a capability ceiling. - [ ] Implement explicit root/cwd/PATH resolution confined to delegated namespace/executable roots; environment text, absolute paths and `..` cannot escape the realm or select an undelegated service. - [ ] Implement resource accounting for process/thread/fd/memory/temp and in-flight work, with deterministic exhaustion and no fixed accidental table cap. - [ ] Implement noninteractive build policy: out-of-envelope operations fail promptly with documented errors, without hanging for a hidden prompt. - [ ] Implement realm teardown on normal exit, crash, denied transfer, launch abort, timeout and supervisor failure; retire all descendants/aliases and prove process/realm generation reuse cannot recover prior authority. - [ ] Add two-realm isolation VMs for filesystem, process, credentials, descriptors, service routes and teardown; include malicious message replay. - [ ] Package/start `posixd` from ext4 after the required native services; keep compatibility orchestration out of rootd and preserve READY/shell ordering. - [ ] Implement runtime exceptional-authority requests from running compatibility processes through their authenticated launch/realm route; resolve only within the caller's existing delegated selector ceiling. - [ ] Bind every grant to exact process/job/realm generations, resolved object identity, permitted operation and explicit one-shot/invocation/transaction lifetime. Never turn approval into a broad directory or reusable admin grant. - [ ] Extend trusted prompt descriptions for compatibility programs to show executable provenance, operation, object and lifetime; escape untrusted labels and keep labels/argv/paths non-authoritative. - [ ] Preserve automatic same-session secure attention, trusted y/n plus Enter decisions, renderer acknowledgement and fresh-input fences on serial and framebuffer TTYs. Untrusted PTY output cannot approve or spoof a prompt. - [ ] Deliver approved grants to the exact still-running process using explicit caller-local slots and tracked revocable aliases; reject stale, replaced, cancelled or already-exited recipients and clean partial delivery. - [ ] Implement operation-completion/denial/timeout/cancellation/revoke cleanup, including process death during approval and errors after one-shot consumption. No grant remains reusable by a later process or shell command. - [ ] Support exact-entry unlink/rename/truncate and reviewed recursive transaction envelopes; require a fresh explicit policy for any traversal scope, and prove rollback/partial-progress rules without ambient parent-directory write. - [ ] Add interactive VMs for approve, deny, revoke, malformed grant, object replacement, process exit, wrong TTY, replay and two-realm isolation; add a noninteractive build VM proving no prompt or silent escalation occurs. ### Files, descriptors and namespace semantics Weight: 6%; accepted: 0/15. [Owning issue](https://git.erikinkinen.fi/erix/posixd/issues/2) · [posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5). - [ ] Implement per-process fd tables distinct from shared open-file descriptions; record rights, offset, status flags, inheritance and alias count. - [ ] Implement open/openat/close and dup/dup2/fcntl duplication with atomic replacement, lowest-free allocation and complete transfer cleanup. - [ ] Implement read/write/pread/pwrite/readv/writev and lseek as required, covering zero/short I/O, shared offsets, append atomicity, EINTR and nonblocking. - [ ] Implement pipe endpoints, EOF/hangup/broken-pipe semantics and bounded buffering; descriptor closure must wake exactly the affected waiters. - [ ] Implement stat/fstat/lstat/fstatat, readdir and seekable directory iteration with stable identity, correct dot entries, mode/size/link counts and source-qualified ctime/mtime/atime behavior. - [ ] Implement mkdir/rmdir/unlink/link/symlink/readlink/rename variants required by the workload, with exact-entry authority and atomic visibility; cross-filesystem operations fail deterministically without partial mutation. - [ ] Resolve the existing held-directory pin restrictions against POSIX cwd/open-object rename/unlink expectations; implement safe object lifetime and namespace detachment without reverting to path-based reopening or stale grants. - [ ] Implement truncate/ftruncate, sparse growth, fsync/fdatasync and durability contracts; test concurrent access, ENOSPC and interrupted failure. - [ ] Implement required mode/umask/ownership/access/ACL semantics with an explicit trusted metadata source. ACL byte preservation alone is not permission enforcement; unsupported provider behavior must be explicit. - [ ] Implement mkstemp/temp-directory and atomic output replacement semantics within delegated tmp/output trees; no host `/tmp` or ambient search. - [ ] Implement required advisory locks with process/open-description lifetime, contention, cancellation and crash cleanup for Cargo/Git/build tools. - [ ] Implement poll/select readiness, timeout and cancellation using race-free event registration rather than periodic busy loops or fake timeouts. - [ ] Provide only manifest-required local socket/socketpair semantics through bounded endpoints. Network sockets remain unavailable without later networking authority; device-node names alone grant no device access. - [ ] Test symlink/parent traversal, rename races, fd/PID reuse, shared offsets, directory lifetime, revoked handles and mutation outside scope. - [ ] Add multi-process build-style filesystem VMs for parallel files, atomic rename, locks, large trees, long paths and explicit resource exhaustion. ### Memory, threads and blocking primitives Weight: 6%; accepted: 0/12. [Owning issue](https://git.erikinkinen.fi/erix/kernel/issues/1) · [kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3). - [ ] Inventory required allocation/mmap/protection/shared-memory/thread interfaces from selected tools and distinguish missing mechanisms from libc adapters over existing capabilities. - [ ] Implement authorized anonymous allocation and release for growing heaps/stacks, with checked alignment, zero initialization, quotas and OOM cleanup. - [ ] Implement required private/file-backed mmap, munmap, mprotect and synchronization behavior; preserve W^X, backing rights, dirty data and revocation. - [ ] Specify thread/process address-space ownership, thread start/exit/ join/detach, stack guards and cleanup with no unintended capability inheritance. - [ ] Implement per-thread TLS allocation, access base and destructor lifetime, integrating ABI and loader contracts; isolate errno and thread data. - [ ] Implement mutex/condition/rwlock/once/TLS-key primitives required by libc/tools with correct atomic ordering, wakeup ownership and destruction. - [ ] Implement race-free check/register/block/wake and actual monotonic deadlines; test notify-before-wait, wake-after-cancel, spurious wakeups, lost wakeups, priority/fairness effects and generation reuse. - [ ] Define fork interactions with multiple threads, atfork handlers, runtime locks and child state; no inherited lock may require a vanished thread. - [ ] Specify unwind/exception support needed by imported C++/Rust tools separately from native abort-only components; do not enable unwinding across kernel, IPC or incompatible FFI boundaries. - [ ] Provide explicit clock and entropy access needed by runtimes. Distinguish reproducible timestamps/test randomness from security randomness; never satisfy a cryptographic entropy request with deterministic fixture data. - [ ] Add stress/failure VMs for mapping protection, concurrent allocation, threaded compilation, TLS isolation, wakeups, joins and teardown under OOM. - [ ] Profile allocation, faults, mapping transitions and synchronization; optimize only measured costs after safety and lifecycle tests pass. ### Process, fork/exec/wait and signals Weight: 6%; accepted: 0/13. [Owning issue](https://git.erikinkinen.fi/erix/posixd/issues/3) · [posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5). - [ ] Specify fork's exact snapshot, return values, native generation, POSIX PID, shared open descriptions and allowed capability inheritance. A shell's descriptive subshell checkpoint is not a process fork. - [ ] Implement correctness-first private address-space copying unless a separately reviewed copy-on-write mechanism is justified; duplicate only selected memory/descriptor rights, never a service's private receive authority. - [ ] Implement atomic child publication and full unwind for allocation, mapping, transfer or startup failure; parent state remains usable and no half-started child or leaked authority remains. - [ ] Implement execve/exec-family replacement using exact executable identity, manifest, realm policy, argv/env, inherited descriptors and signal rules; success replaces the image, failure preserves the prior process. - [ ] Implement posix_spawn/file actions if required by imported tools; preserve the same inheritance/security semantics and test fork/exec equivalence where specified. Do not fake fork by always taking a spawn-only path. - [ ] Implement wait/waitpid and required wait options with exact child status, zombie retirement, multiple waiters, interruption and PID reuse safety. - [ ] Implement process groups/sessions and terminal foreground ownership entirely within delegated namespaces; numeric group IDs cannot grant control. - [ ] Implement sigaction, masks, pending delivery, default/ignore/caught dispositions, unblock ordering and supported signal sets with explicit state. - [ ] Implement safe user handler entry/return, alternate stack if required, validated restored context and async-signal-safe runtime paths; never unwind across unauthorized frames or trust caller-provided privileged CPU state. - [ ] Implement signal-driven EINTR/restart, SIGCHLD/wait ordering, SIGPIPE, stop/continue and terminal job-control behavior required by the profile. - [ ] Implement per-process CPU/resource queries and required limits with real counters; elapsed wall time and child CPU time remain distinct. - [ ] Add fork/exec/wait VM matrices covering descriptor aliasing, close-on-exec, environment, cwd, TLS, signals, multi-thread fork, failures, concurrent children and termination while authority demand is pending. - [ ] Add cross-realm signal/control denial, stale-PID replay, descendant cleanup and repeated fork/exec exhaustion/recovery VMs; verify no residual caps. ### C runtime and libc Weight: 5%; accepted: 0/12. [Owning issue](https://git.erikinkinen.fi/erix/lib-cstd/issues/1) · [lib-cstd PR 3](https://git.erikinkinen.fi/erix/lib-cstd/pulls/3). - [ ] Define static/shared libc artifacts, C headers, symbol/export versioning, startup objects, calling conventions and supported C language ABI. - [ ] Implement C entry/exit, argc/argv/env/auxiliary data, atexit and initialized runtime state from validated launch input; no ambient discovery. - [ ] Implement memory/string/byte functions with overlap/alignment/ zero-length/overflow tests and documented FFI pointer contracts. - [ ] Implement malloc/calloc/realloc/free/aligned allocation using [Memory, threads and blocking primitives](https://git.erikinkinen.fi/erix/kernel/issues/1), covering ownership, failure atomicity, zeroing and threaded use. - [ ] Implement errno and error strings per thread with stable native error mapping; unrelated calls/threads must not overwrite each other's state. - [ ] Implement buffered stdio, formatting/scanning and conversion surfaces required by tools; cover partial I/O, flush-on-exit, stream locking, binary data, locale, numeric bounds and varargs ABI. - [ ] Implement libc file/directory/poll/terminal adapters over `posixd`; no direct provider routes or host-OS syscall fallback may bypass mediation. - [ ] Implement process/signal/thread adapters over reviewed native mechanisms; libc process-global state must have defined fork/exec behavior. - [ ] Implement time/sleep, locale/ctype/multibyte, environment, sorting, search and required math/runtime helpers with deterministic documented behavior. - [ ] Implement only required additional C/POSIX interfaces identified in [Scope, repository and build inventory](https://git.erikinkinen.fi/erix/integration/issues/1); track every unsupported extension with explicit behavior and tool configuration/port justification, not success-returning stubs. - [ ] Build independent C conformance probes for layout, linking, constructors, TLS, allocation, stdio, files, threads, signals and process lifecycle. - [ ] Validate FFI safety and C/Rust interoperability under errors, malformed inputs and stress; publish rustdoc/header/manual contracts and pass full strict CI for `lib-cstd` and changed consumers. ### Compatibility ELF and runtime linking Weight: 4%; accepted: 0/10. [Owning issue](https://git.erikinkinen.fi/erix/dynlinkd/issues/1) · [dynlinkd PR 3](https://git.erikinkinen.fi/erix/dynlinkd/pulls/3). - [ ] Inventory emitted ELF/interpreter/dynamic tags, relocations, symbol versions, TLS models, constructor/finalizer and exception metadata from exact selected compiler/runtime packages. - [ ] Define/version a compatibility artifact contract distinct from native abort-only/no-TLS/no-init-fini policy; preserve rejection of unsupported native artifacts instead of simply deleting existing guards. - [ ] Implement required relocations and dynamic symbol rules with exact bounds, dependency closure, cycle/duplicate behavior and no ambient library search. - [ ] Implement static/dynamic TLS layout and per-thread/module lifecycle with checked template/BSS alignment, unload rules and [Memory, threads and blocking primitives](https://git.erikinkinen.fi/erix/kernel/issues/1) synchronization. - [ ] Implement ordered constructors/finalizers and runtime teardown with failure handling; no initializer executes before validation and final mappings. - [ ] Implement declared runtime library loading needed by Python modules and compiler plugins/proc macros; restrict dlopen-like search to granted library roots and retire mappings/aliases only after their users are gone. - [ ] Implement required unwind registration/lookup in compatibility userspace only; validate metadata and keep native/kernel abort policy intact. - [ ] Enforce W^X, relocation/RELRO permissions, manifest identity and dependency closure for imported objects; reject text relocation/lazy binding/ IFUNC modes unless separately required, designed, tested and approved. - [ ] Test malformed ELF, dependency substitution, TLS races, constructor failure, symbol ambiguity, plugin teardown and out-of-realm library lookup. - [ ] Run actual compatibility ELF/TLS/C++ exception/Rust runtime VMs and native-loader regression scenarios with strict warning-free component CI. ### Shell, utilities, help and manual pages Weight: 5%; accepted: 0/18. [Owning issue](https://git.erikinkinen.fi/erix/exsh/issues/1) · [exsh PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3). - [ ] Compare exsh's maintained POSIX conformance register and actual build scripts against the selected POSIX shell standard; enumerate remaining syntax, expansion, built-in, signal, group and stopped-job gaps with tests. - [ ] Complete standard POSIX shell behavior needed for ordinary scripts and all remaining mandatory profile items; preserve native descriptor/job authority and distinguish true fork from in-process descriptive state copying. - [ ] Implement compatibility-program launch from exsh without executable-name/argv-specific authority semantics; tools request/fail operations on their own, within the launch envelope. - [ ] Complete pipeline/redirection/substitution/here-document/background/ wait/trap/job-control interactions against real POSIX processes and groups. - [ ] Test configure/build scripts with spaces, long argv/env, nested substitutions, many descriptors, interruption and concurrent output; remove incidental shell storage limits through caller/resource-owned growth. - [ ] Inventory native utility command/option gaps against build recipes; implement required clean-room behavior in thematic modules and record where an explicitly inventoried extended GNU tool is required instead. - [ ] Preserve history/editor/cursor/erase, independent and mirrored TTYs, serial/fbcon trusted consent, output drain and repeated-command behavior under build load; add focused and existing regression VM coverage. - [ ] Run shell/utility conformance fixtures plus a miniature parallel build workflow, checking exact output/status and zero authority leakage. - [ ] Specify an internal exsh `help` command with Bash-like behavior: no-argument topic listing, pattern/topic selection, short description (`-d`), manual-style output (`-m`), synopsis (`-s`), option errors and match/no-match exit statuses. Verify combinations against the selected Bash reference. - [ ] Implement `help` from exsh's authoritative built-in/topic registry, documenting actual exsh behavior rather than advertising unimplemented Bash extensions; it must not spawn an external executable or acquire filesystem authority for built-in help. Author original explanatory text. - [ ] Add unit and serial/PS2 harness tests for help listing, topic/pattern selection, flags, invalid requests, redirection, pipelines and exit statuses. - [ ] Specify `coreutils man`: section/name lookup, disambiguation, multiple pages, search/index behavior, terminal versus redirected output, missing-page errors and scoped manual-directory discovery. - [ ] Implement `man` as a native coreutils applet with readable paging, scrolling/search/quit and plain-text fallback for pipes; safely parse the chosen documented man format and never execute page macros, escapes or embedded commands. - [ ] Define stable manual sections/names for all CLI commands/built-ins, IPC interfaces and Rust/C linkage APIs; inventory every exported interface and require an indexed page or a clearly linked owning API page. - [ ] Write/package CLI manual pages covering syntax, options, examples, statuses, authority needs and errors for every tool, including `help`, `man`, `boot-tool`, `sha2-tool`, exsh and extop; include admitted extended-tool manuals only under their declared source/license/manifest policy. - [ ] Write/generate IPC and Rust/C API manual pages with ABI/version, request/reply layout or signatures, safety/ownership/lifetime/authority, errors, examples and cross-references to canonical rustdoc/header/manual text. - [ ] Install man pages/indexes on ext4 as build outputs with explicit read-only lookup authority; environment paths cannot broaden the manual scope or cause execution. Make docs available without network access on both images. - [ ] Add coverage/freshness and malformed-page tests plus serial/PS2 `man` navigation, resize, pipe/redirection, missing-page and denied-root VMs. Verify every CLI/interface inventory entry resolves to useful current content. ### Extended payloads and image isolation Weight: 4%; accepted: 0/9. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/4) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Implement a versioned third-party payload manifest containing name, version, source digest, license/notices, target, recipe/patch digests, features, runtime dependency closure, dynamic dependencies and realm authority policy. - [ ] Define offline source ingestion and reproducible recipe storage; keep imported sources/patches separate from EriX-authored ISC implementation and never add imported libraries to trusted EriX Cargo dependencies. - [ ] Add explicit `runtime.extended-dev.toml` and `runtime.extended-release.toml`, labeled non-clean-room in metadata/output. Preserve existing clean `runtime.dev.toml` and `runtime.release.toml` semantics. - [ ] Enforce clean-profile exclusion across configuration inheritance, local overrides, aliases, caches, transitive libraries and packaged contents; test intentional imported-payload contamination fails closed. - [ ] Enforce a reviewed extended-release subset; exclude development-only generators/test harnesses/debuggers and unneeded dependency libraries. - [ ] Verify every admitted target ELF and declared DT_NEEDED closure, source/license/recipe record and authority envelope; reject unknown payloads, mismatched targets, dependency-only orphans and mutable unpinned sources. - [ ] Reconcile the phase inventory with newly discovered packaging and documentation dependencies before admission; update normative inventory, manifest schema/records and tests rather than silently expanding imports. - [ ] Package admitted tools on ext4 with bounded executable/library manifests; the build realm gets no raw block/device/key/global discovery or network capability from extended-image selection. - [ ] Test all four profile builds, labels, artifact inventories and clean-room exclusion independently; extended-tool success never certifies clean-room implementation provenance. ### EriX-hosted imported toolchain Weight: 5%; accepted: 0/19. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/7) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Pin exact upstream sources, compiler versions, recipe options and licenses for every selected tool/runtime; create a dependency-ordered offline bootstrap graph distinguishing build-machine, EriX-host and output targets. - [ ] Implement/review EriX target support and sysroot integration for Rust/LLVM/C tooling, including actual `std` OS bindings over `lib-cstd`, TLS, threads, process, files and time. A target JSON alone is not host support. - [ ] Build target `core`, `alloc`, `std`, `proc_macro`, compiler runtime and `test` libraries; separate imported runtime payloads from trusted native component dependencies and record each runtime link closure. - [ ] Cross-build EriX-hosted `rustc`, `cargo`, `rustdoc`, `rustfmt`, `clippy-driver`, LLVM code-generation libraries and Rust linker support from selected upstream sources against EriX libc/sysroot and Rust OS bindings; execute each within an EriX realm. Retain exact static/dynamic link closure evidence; copying or merely relabeling Linux binaries is not a compiler port. - [ ] Build from source and verify EriX-hosted LLVM tools against the EriX sysroot: `clang`, `clang++`, `lld`, `llvm-ar`, `llvm-ranlib`, `llvm-nm`, `llvm-objcopy`, `llvm-strip`, `llvm-readobj`, `llvm-readelf`, `llvm-size`, and `llvm-config` when the recipe requires it. - [ ] Build only declared compiler-rt, libunwind, C++ runtime and compression/runtime dependencies; test C/C++ allocation, TLS, threads and exceptions as required by those exact compiler binaries. - [ ] Port/verify Python 3 and required standard modules, including the selected compression, FFI and optional database extensions used by EriX scripts. - [ ] Port/verify CMake, Ninja, GNU make, pkgconf/pkg-config and declared bash use; test generated build rules, subprocess pipes and parallel job limits. - [ ] Port/verify offline Git operations: init/status/diff/log/checkout, exact local revision resolution and offline Cargo Git dependency use; disable fetch/network paths and preserve exact commit identity in manifests and caches. - [ ] Port/verify archive/compression tools: tar, gzip, xz, zstd and bzip2, with reproducible round trips, permissions, symlinks and path-escape rejection. - [ ] Port/verify required patch/diff/cmp/find/grep/sed/awk/sort/install and file/object-probe behavior not supplied by native tools; record exact options. - [ ] Port/verify extended-dev Autotools support: m4, autoconf, automake, libtool, bison, flex and Perl with a representative configure/build fixture. - [ ] Admit dependency-only zlib/bzip2/liblzma/zstd/libarchive/libuv/libffi/ sqlite/pcre2/expat/gettext/iconv/terminfo/readline components only when selected tools require them; disable optional TLS/download/network features for Phase 6. - [ ] Resolve required image/filesystem, Markdown and TeX tool dependencies through [Extended payloads and image isolation](https://git.erikinkinen.fi/erix/integration/issues/4) or clean-room equivalents. No unlisted helper may run on the external host during the final build to fill a missing guest tool. - [ ] Require every tool's smoke command, deterministic exit and minimal startup capability test before admission; version output alone is insufficient. - [ ] Run functional fixtures: Rust program/crate, offline Cargo workspace, build script and proc macro, C/C++ compile/link, Python bootstrap scripts, CMake/Ninja/make, local Git and archive/text round trips. - [ ] Run each tool class under missing/revoked grants, uid 0 metadata, out-of-tree paths, device names and unavailable network; verify denial and teardown without a compiler/tool-specific launch exception. - [ ] Profile real compiler/workspace builds and fix evidenced substrate bottlenecks through [Integration profiler and measured optimization](https://git.erikinkinen.fi/erix/integration/issues/3), preserving per-job resource ceilings and exact errors. - [ ] Rebuild the selected upstream Rust/LLVM toolchain and required runtime closure inside an extended development EriX realm using the supplied offline sources, recipes, dependencies and cross-built EriX-hosted bootstrap compiler/sysroot. Require the delivered build to work without unrecorded porting changes, implicit downloads, Linux executables or host build delegation. Verify EriX libc/ABI linkage, execute the guest-built tools and compile/link/run Rust and C/C++ fixtures, including build scripts and proc macros. Use the rebuilt compiler for at least one required full EriX build. Retain exact source/patch/bootstrap/tool/runtime hashes, complete logs, actual outcomes and measured memory/time requirements under explicit build quotas. Cross-compilation and version output alone do not satisfy this acceptance. ### Native tools and full build/packaging pipeline Weight: 5%; accepted: 0/21. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/8) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Provide a signed/hash-verified source bundle of all exact component revisions, locks, recipes, configs and local dependency metadata with no EriX precompiled output. Reject missing or unexpected sources before building. - [ ] Implement the build realm: immutable source/toolchain inputs, separate write-only-as-needed build/output/tmp trees, explicit execution and child lifecycle authority, fixed locale/time policy and bounded resources. - [ ] Resolve source-write assumptions by declaring writable generated worktrees separately from immutable originals; never silently grant compiler writes to the source authority root. - [ ] Adapt component orchestration and Cargo override/lock resolution for fully offline EriX execution; record every invoked guest tool, target, input/output digest and job dependency. Remove host `/proc`/`/sys` assumptions. - [ ] Build EriX-hosted `boot-tool`, `sha2-tool` and every other maintained build helper inside EriX before using them to produce final artifacts; the first two use native EriX APIs through [Native tools and full build/packaging pipeline](https://git.erikinkinen.fi/erix/integration/issues/8), not a POSIX-only port. - [ ] Build the complete target/profile graph from [Scope, repository and build inventory](https://git.erikinkinen.fi/erix/integration/issues/1), including all services/libraries, kernel, EFI bootloader and Integration test artifacts; fail if a catalog entry is silently skipped due to missing build configuration. - [ ] Generate complete dynamic/launch/boot manifests and signed `boot.img` inside EriX, with deterministic source epoch, ordering, padding, feature identity and no preassembled host artifact substitution. - [ ] Resolve current `dd`, `debugfs`, `mkfs.fat`, `mkfs.ext4`, `mcopy`, `mmd`, `sgdisk`, truncate/hash/compression and Python packaging dependencies. Prefer a reviewed image-file-only path using owned code where appropriate; any imported alternative needs [Extended payloads and image isolation](https://git.erikinkinen.fi/erix/integration/issues/4) admission and actual guest functional tests. - [ ] Assemble GPT, FAT ESP and ext4 partitions into ordinary output image files inside EriX, without granting the build realm raw block, mount administration or access to the currently running disk device. - [ ] Build clean dev/release and explicitly selected extended profiles with equivalent validated boot/runtime closures; verify clean images exclude imported compiler payloads even though an imported compiler produced them. - [ ] Define least-authority artifact signing: a build requests signing of an exact reviewed artifact identity under a dedicated test/development key policy; no private key bytes, broad key service or release key enter the realm. - [ ] Produce checksums, compression, manifests, generated API references and complete technical manual within EriX using the declared tool closure. Run warning-free guest fmt/Clippy/unit/documentation checks on built sources. - [ ] Implement restartable build steps with verified input/output cache identities, bounded parallelism, meaningful progress and deterministic cleanup; final clean-build evidence must disable reuse of prior EriX outputs. - [ ] Test failed compiler, OOM/ENOSPC, interrupted build, malformed cache, signer denial and partial image creation; retain diagnostics and remove only owned temporary artifacts without corrupting source or running media. - [ ] Verify image-file parsing, signatures, partition/filesystem metadata, payload closures and reproducibility inside EriX before exporting results for independent host inspection/boot orchestration. - [ ] Separate `boot-tool` and `sha2-tool` command/format/hash logic from platform I/O; specify native EriX and Linux backends sharing exact CLI, errors, output and artifact formats without routing the EriX backend through libc. - [ ] Port `sha2-tool` to native startup/CLI/stdio/file capability APIs; stream large inputs, preserve stdin/file modes, bound temporary storage and retire all input/output grants on success, denial and interruption. - [ ] Port `boot-tool` image operations to native EriX file/stream APIs; preserve build/inspect/verify/signing-payload semantics and the detached signer boundary. Neither platform backend may gain implicit private-key access. - [ ] Keep Linux targets usable with the existing CLI and build recipes; test shared logic plus both backends and byte-identical image/hash output from the same fixture inputs, including empty, large and malformed files. - [ ] Package both native executables/metadata/man pages on ext4, add scoped launch contracts and new serial/PS2 in-OS CLI tests for both tools; test wrong/missing grants and partial-output cleanup without program-specific launch authorization. - [ ] Use the newly guest-built native tools in [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9) for image operations and checksums; show Linux regression CI remains green and no host fallback or POSIX adapter secretly performs their native guest operations. ### Two-generation self-hosting demonstration Weight: 6%; accepted: 0/16. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/9) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Freeze the acceptance source/toolchain/recipe/image hashes, complete output inventory, resource/timeout policy and exact build command in a reviewed runbook. Fix all prerequisites before declaring the timed demonstration started. - [ ] Provision a private seed extended image with admitted EriX-hosted tools and source-only inputs. Use an empty output tree and no prior EriX object, incremental, image, generated-metadata or host tool cache. - [ ] Boot the seed EriX and record guest identity, native process/realm provenance, mounted authority inventory and tool versions; disable networking and host shared-directory/build-RPC fallbacks. - [ ] From exsh in that EriX session, execute the complete build command. Record each compile/link/generate/sign/package step as an EriX process with exact input/output evidence and actual exit status. - [ ] Complete all [Scope, repository and build inventory](https://git.erikinkinen.fi/erix/integration/issues/1) outputs, including every EriX component, signed boot image, UEFI loader, clean dev/release disks, selected extended disks and generated documentation/manifests. Compare inventory cardinality and hashes; a missing target or substituted prebuilt output fails the demonstration. - [ ] Run guest fmt/strict Clippy/unit/doctest checks and relevant guest tool/authority-negative tests on that graph; preserve zero-warning full logs. - [ ] Validate partition/ELF/signature/source closure, then export only completed artifacts/evidence through an explicitly authorized path. The host may record, independently verify and boot them, but may not repair or assemble a missing build output. - [ ] Boot the newly guest-built clean dev and release images and run their canonical runtime probes; boot the guest-built extended-dev image for the second-generation build. Record exact booted image hashes. - [ ] In that newly built EriX, provision the same immutable sources/tools and fresh empty output/tmp trees, then perform a second complete build without importing first-generation compiled EriX artifacts or mutable caches. - [ ] Compare first/second-generation complete artifact inventories and deterministic bytes/signatures using the fixed inputs. Investigate every difference; normalization is allowed only for fields explicitly specified before the run, never to erase unexplained payload differences. - [ ] Run the complete maintained VM catalog and post-image probes on matching guest-built artifacts. The external supervisor may start test VMs; nested virtualization inside EriX is not required and must not conceal a host-side build step. - [ ] Demonstrate source read-only, output/tmp confinement, executable scope, no device/raw-block/key/network/global discovery and no cross-realm control; test denied access, interrupted build and complete realm teardown. - [ ] Profile the self-host builds, report actual elapsed/CPU/I/O/memory figures and apply the predeclared budgets; close proven bottlenecks through reviewed fixes and a new complete evidence cohort, not partial retries to green. - [ ] Publish a reproducible evidence bundle: source graph, manifests, tool licenses/recipes, commands, full logs, profile summaries, negative tests, output hashes/signatures, boot/test results and independent review. - [ ] Include [Signing, rootfs verification and UEFI Secure Boot](https://git.erikinkinen.fi/erix/bootloader/issues/1) trust-chain verification in both generations: custom-key Secure Boot, signed boot image and all rootfs authority/code objects. Exercise tampering/revocation failures before declaring the guest-built result accepted. - [ ] Initiate/observe the build through [Extensible serial/PS2 CLI input harness](https://git.erikinkinen.fi/erix/integration/issues/5)'s real serial/PS2 CLI input paths, run native boot/hash tools, and verify [Consoles, vttys, mouse, TUI and boot logo](https://git.erikinkinen.fi/erix/ttyd/issues/1)'s independent TTY/default-clear behavior, vtty switching, mouse selection/paste, boot logo and help/man/extop acceptance on the newly produced images. ### Final CI, audits and alpha-review handoff Weight: 4%; accepted: 0/15. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/10) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Run final fmt, default/all-valid-feature strict Clippy, unit tests, doctests, target/profile builds and rustdoc for every altered repository at its exact final signed revision, with no warnings and no unexplained skipped tests. - [ ] Verify every new runtime feature has positive, authority-negative, malformed-input, interruption/cleanup and bounded VM integration coverage. - [ ] Run the full old-plus-new VM catalog and all canonical/post-image probes; reconcile authored scenario counts, source/worker ownership, expected exits, images and retained failures. Existing 486 cases are a baseline, not a fixed future denominator that permits dropping tests. - [ ] Enforce real per-scenario hard/stall deadlines and owned-process cleanup in CI; test stalled guests/helpers fail and release their worker. Report progress throughout long full-build jobs without fabricating liveness. - [ ] Monitor exact-head CI for every repository, including nested crates and older unit/VM regressions; classify pending/cancelled/stale/missing evidence separately. Fix failures and warning-bearing green jobs before acceptance. - [ ] Keep Rust fmt/Clippy/tests in each crate's canonical `ci.yml`, including Integration's library job; remove unsupported Forgejo workflow permissions fields and use authorized integrations only for needed capabilities. - [ ] Re-run the independent whole-codebase [Whole-codebase authority and quality audit](https://git.erikinkinen.fi/erix/integration/issues/2), [Rustdoc, missing_docs and documentation](https://git.erikinkinen.fi/erix/docs/issues/1) audit and check zero deprecated APIs, over-limit authored code files, missing inline docs and unresolved ambient/residual/unwanted explicit authority findings. - [ ] Verify compiler/dependency commit-pin policy, clean/extended image isolation, signed source/artifact provenance, reproducibility and rollback/ upgrade behavior for changed persistent or ABI contracts. - [ ] Re-run uninstrumented startup and declared build-performance gates on the final graph; an earlier candidate's speedup or predecessor CI cannot certify a later graph. - [ ] Reconcile every component's canonical README/ARCHITECTURE/ROADMAP, `docs/phases/6.md`, manual/API references and operator self-hosting runbook with observed behavior, supported limits and exact final evidence. - [ ] Push all final signed `feature/posix-compat` trees and coherent Integration pins; verify remote heads/signatures and their own terminal CIs. Do not silently merge, retag, rewrite history or replace main images. - [ ] Close [canonical acceptance criteria](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md) using the linked acceptance contract, record final percentage and remaining later-phase non-goals, and request explicit promotion direction for accepted images. Do not declare Phase 6 complete before [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9), [Final CI, audits and alpha-review handoff](https://git.erikinkinen.fi/erix/integration/issues/10) actually pass. - [ ] Close the supplementary [Public Forgejo issues and PRs](https://git.erikinkinen.fi/erix/meta/issues/2), [Extensible serial/PS2 CLI input harness](https://git.erikinkinen.fi/erix/integration/issues/5), [Signing, rootfs verification and UEFI Secure Boot](https://git.erikinkinen.fi/erix/bootloader/issues/1), [Consoles, vttys, mouse, TUI and boot logo](https://git.erikinkinen.fi/erix/ttyd/issues/1) and [Whole-codebase authority and quality audit](https://git.erikinkinen.fi/erix/integration/issues/2), [Rustdoc, missing_docs and documentation](https://git.erikinkinen.fi/erix/docs/issues/1)/[Shell, utilities, help and manual pages](https://git.erikinkinen.fi/erix/exsh/issues/1), [Native tools and full build/packaging pipeline](https://git.erikinkinen.fi/erix/integration/issues/8) gates, including signed downloadable boot artifacts, all-file authority verification, real-input CLI coverage, native tools, manuals and human-legible documentation/code. - [ ] Reconcile public issues, PR checklists, evidence links and this tracker; remove "WIP: " only from genuinely accomplished PR goals and leave unresolved/dependent work visibly open. - [ ] Prepare the `v1.0.0-alpha.1` manual-review dossier: complete source graph, self-host proof, security/CI/performance results, licenses, custom-key enrollment/recovery instructions and known non-goals. Wait for explicit manual approval before merges, version promotion, release tags or artifact promotion. ### Public Forgejo issues and PRs Weight: 2%; accepted: 3/10. [Owning issue](https://git.erikinkinen.fi/erix/meta/issues/2) · [meta PR 4](https://git.erikinkinen.fi/erix/meta/pulls/4). - [x] Verify the deployed Forgejo version, authenticated identity and minimum organization/repository permissions using the authorized credential without exposing it; do not assume another version’s API support or silently widen privileges. - [x] Create public work-package and bounded implementation/audit issues in the owning repositories, with descriptive titles, dependency links, acceptance criteria and authority rationale. Preserve confidential coordination identifiers and evidence. - [x] Maintain an idempotent issue/PR mapping and update process; detect existing objects before creation, preserve human edits, and avoid duplicates or unsupported completion claims. Keep this master checklist, totals, dependencies and evidence current whenever scope or acceptance changes. - [ ] Ensure every altered repository, including docs/meta/new libraries, has a `feature/posix-compat` PR with the exact "WIP: " title prefix after its first pushed checkpoint; use draft mode as well if supported, not instead of the required prefix. Link dependent PRs and the matching component graph. - [ ] Keep PR descriptions current with implemented versus planned scope, security decisions, validation/failures, exact CI revisions and issue references. Publish concise meaningful progress rather than private raw logs. - [ ] Make public updates through the user's authorized account/configured identity without mentioning AI-agent attribution; never assert the user has personally reviewed, approved or signed something when that has not occurred. - [ ] Keep API tokens, signing secrets, private paths/logs and sensitive vulnerability detail out of public issues, PRs and artifacts; restrict actual security reports as required while recording a non-sensitive tracking link. - [ ] For every new repo, verify absence, create remotely from `meta` as template, verify static-file inheritance, clone, branch, specialize and open its WIP PR. Add audit/CI/docs/manual/catalog and public issue records before consumers depend on it; no local-first blank repository substitution. - [ ] Close an issue and remove "WIP: " only when its declared goal and required cross-repository/CI gates actually pass; keep the coordinated Phase 6 PR WIP until the whole phase is accomplished. Readiness is not merge approval, and successful Phase 6 is not alpha-release approval. - [ ] Reconcile all altered repositories, open issues, PR states and local progress at each milestone/final handoff; link each accepted result to its signed revisions and public review evidence. ### Extensible serial/PS2 CLI input harness Weight: 3%; accepted: 0/17. [Owning issue](https://git.erikinkinen.fi/erix/integration/issues/5) · [integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). - [ ] Inventory current serial/physical helpers, guest-script injection, direct orchestration launch and output oracles; separate genuine CLI tests from low-level protocol/kernel fixtures before migrating them. - [ ] Define a versioned input-backend interface for capabilities, connect/select-session, send text, press/release keys, modifiers/chords, synchronization and teardown; keep scenario intent independent of transport. - [ ] Implement serial input over an explicitly selected UART/PTY route, including encoding, line endings, fragmented escapes, partial writes, reconnect policy and bounded backpressure without bypassing seriald/ttyd. - [ ] Implement PS/2 keyboard input through the emulated device path, including scan codes, make/break, modifiers, repeat, arrow/delete and secure attention; do not inject directly into the shell or trusted-input endpoint. - [ ] Make unsupported backend capabilities explicit and reject them before a test starts; document how a future USB/HID or other backend plugs in without changing every scenario or inventing synthetic trusted input. - [ ] Bind commands and observations to one exact TTY/session per run. For independent terminals, PS/2 completion must use its framebuffer/session output, not unrelated serial log stamps; never send a command through both backends and accept whichever output happens to arrive. - [ ] Implement transcript expectations for exact output, status, prompt, cursor/redraw, timeout and completion, with structured failure context; screenshots/framebuffer state must corroborate visual assertions where needed. - [ ] Add fake-backend unit tests for partial input, key-up cleanup, malformed escapes, stuck modifiers, cancellation and stale sessions; hard-bound helper/QEMU lifetimes and retain original status on observation failure. - [ ] Add real serial and PS/2 VM tests for editing/history, pipelines, redirection, Ctrl-C, foreground/background jobs and y/n plus Enter consent; prove ordinary input cannot impersonate trusted approval or another TTY. - [ ] Migrate CLI/tool acceptance scenarios to the shared real-input API, including boot-tool, sha2-tool, help, man, extop and self-host build commands; preserve existing assertions and record every renamed/retired case mapping. - [ ] Keep low-level non-CLI protocol/negative fixtures when needed, but do not count directly launched test scripts or hidden rootd orchestration as primary evidence that a user can operate a CLI tool. - [ ] Run backend coverage in CI for serial-only, framebuffer/PS2-only, independent dual and explicitly mirrored modes; preserve existing hard/stall limits and exact source/image/session evidence. - [ ] Remove superseded one-off CLI input adapters after migration, document authoring a new backend/scenario, and add a coverage gate preventing new CLI acceptance tests from silently bypassing the primary input harness. - [ ] Make physical text injection layout-aware while keeping explicit raw key/scan-code fixtures available; run US/Finnish punctuation, modifier and trusted-input cases under the actual boot preference. Serial sends text bytes directly and must not be translated a second time as keyboard scan codes. Record layout and key sequences; use independent expected vectors rather than the production keyboard translator as its own test oracle. - [ ] Extend the physical backend with PS/2 mouse movement and explicit left/middle/right press/release actions, preserving packet boundaries and validated device ingress; never substitute host clipboard or direct guest terminal-state writes for mouse acceptance evidence. - [ ] Add explicit Ctrl+Alt+Fn selection and target-vtty expectations, including held/released modifiers, invalid targets and switching during output or prompts; observe the selected framebuffer vtty rather than a serial sibling. - [ ] Add reproducible visual/text assertions for hidden/revealed cursor, selection and pasted text, plus early boot-logo screenshots tied to exact image/asset hashes. Preserve bounded observation and input teardown on failures. ### Signing, rootfs verification and UEFI Secure Boot Weight: 5%; accepted: 0/37. [Owning issue](https://git.erikinkinen.fi/erix/bootloader/issues/1) · [bootloader PR 3](https://git.erikinkinen.fi/erix/bootloader/pulls/3). - [ ] Inventory the complete trust chain and all authority-controlling root-partition files: executables, libraries, scripts/interpreters, plugins, loader/runtime/launch manifests, service/mount/realm policies, key policy and configuration/includes that can change authority. No code object is exempt because it is imported, generated at runtime or not marked executable. - [ ] Define verification ownership and an authenticated chain from enrolled firmware trust to EFI loader, boot.img, rootfs policy and every admitted executable/library. Existing bare digests are not the requested signature proof. - [ ] Specify a per-file signature or signed catalogue entry authenticating exact final bytes, length, role, relevant metadata/path binding, format/version, dependency closure and signer/policy generation. Every covered file must have verifiable signed coverage; unsigned sidecar hashes are insufficient. - [ ] Specify an acyclic finalization/signing DAG: finish code generation, stripping and capacity/metadata patches before object signatures, finalize authority catalogues before their boot trust anchor, then sign/package final EFI/boot/disk outputs. Avoid circular digest dependencies and post-sign edits. - [ ] Separate firmware PK/KEK/db/dbx certificates/keys from boot/rootfs signing keys and development/build-realm keys; document trust roots, allowed signer roles, rotation/revocation and recovery without reusing a general key. - [ ] Implement signed authority-file generation and verification in maintained tooling with independent known-answer, malformed-format, wrong-role, wrong-key, truncation, tampering and signature-coverage tests. - [ ] Verify policy bytes before applying policy or delegating authority; verify executables and complete library/interpreter/module closures before execution/initializers. Integrity or signer identity alone grants no capability. - [ ] Preserve fresh-object binding from signature verification to use; reject replacement, symlink/race/substitution and stale cache attacks, including lazily read executable pages and reused file handles. Never verify one object and map/execute another or mutable bytes from the same reopened path. - [ ] Define authorized policy/code update and rollback behavior with atomic verified publication, cache invalidation, revocation and interrupted update recovery. Do not promise anti-rollback without a reviewed trusted version/revocation anchor beyond attacker-replaceable disk data. - [ ] Define scoped signing/admission for newly built test programs, Cargo build scripts, proc macros, plugins and compiler outputs before executing them. Bind development signatures to the build realm/output policy; no unsigned output exception or general trusted-system signing oracle is allowed. Separate transient realm-generation-bound admission from reproducible final artifact signatures under fixed declared keys/policy; do not normalize away unexpected final signature differences in [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9). - [ ] Implement the build-output signing route with exact artifact identity, authorized operation, finite lifetime and complete cleanup; keep private key material out of ordinary build processes and `boot-tool` itself. - [ ] Add rootfs tamper VMs for every object/policy class, missing/wrong/ revoked signatures, catalogue substitution, mixed generations and dependency replacement; prove no code runs and no new authority is installed on failure. - [ ] Add an explicit CI signing configuration using a private key from Forgejo secrets for downloadable `boot.img`; separate local test-key builds from protected signed publication and fail closed when required secrets are missing. Never silently fall back to the repository test key for downloads. - [ ] Restrict signing secrets to approved trusted workflow/ref contexts and an isolated signing stage consuming immutable verified artifacts; untrusted PR/fork code and ordinary compile/test scripts receive no signing key. - [ ] Pass secrets through a reviewed non-logging channel to the narrow signer, scrub owned temporary material on success/failure/cancellation and exclude it from caches, dumps, job logs and uploaded artifacts. Verify secret absence without printing/search-reporting its actual bytes. - [ ] Preserve boot-tool's detached payload/signature/verification contract; record public key fingerprint, exact signing payload/artifact hashes, source graph and signing policy without exposing private credentials. - [ ] Publish an explicitly named signed `boot.img` plus verification material/provenance per profile/key cohort, and ensure every downloadable disk contains its corresponding exact tested signed payload and rootfs authority closure; verify downloaded bytes independently of local publisher status. Protected CI re-signing/repackaging creates a separately verified/tested cohort, not a byte-identical [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9) result or permission for hidden host build completion. - [ ] Test protected signing success, missing/wrong secret, untrusted-ref denial, modified input, signer failure and cancellation; publication must stop on failure and no unsigned/test-key output may be mislabeled trusted. - [ ] Implement full supported-platform UEFI Secure Boot packaging with a custom EriX/user-controlled certificate: sign the PE/COFF EFI loader in the firmware-required format and keep its verification material consistent with boot/rootfs trust. An Ed25519 boot.img signature is not firmware EFI signing. - [ ] Provide documented custom PK/KEK/db/dbx enrollment, owner-authorized updates, certificate distribution and revocation/recovery procedures without dependence on a Microsoft signature. Back up existing enrollment and require explicit approval before changing real firmware variables or owner keys. - [ ] Define enforced versus explicitly non-enforced development boot modes and check SecureBoot/SetupMode state where appropriate; never report successful enforcement while firmware is in setup mode or validation is off. - [ ] Add QEMU/OVMF Secure Boot fixtures with private firmware-variable storage and custom enrollment; prove correct-key boot and refusal of unsigned, wrong-key, tampered and revoked EFI images without a permissive fallback path. - [ ] Exercise the full enforced chain with tampered boot.img, rootfs policies, executables and shared libraries; firmware success alone cannot close downstream verification gates. Include both clean and extended profiles. - [ ] Test key rotation/revocation, interrupted updates and documented recovery using independent fixtures, preserving least authority and a usable owner recovery path rather than silently disabling verification. - [ ] Perform a manually approved real-firmware enrollment/boot/rejection validation on the supported hardware baseline; record firmware versions and limitations. OVMF evidence alone is not a claim of universal firmware support. - [ ] Audit signing/verification code and CI boundaries independently, update threat models/rustdoc/man/manual and include malformed crypto/container inputs without introducing third-party code into clean-room components. - [ ] Verify normal signed loading does not retain signer/admin authority in loaders or applications; profile verification overhead through [Integration profiler and measured optimization](https://git.erikinkinen.fi/erix/integration/issues/3) and optimize only exact immutable identities with sound invalidation. - [ ] Include signing/trust tests in the full CI and both [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9) build generations, using scoped development keys for self-host proof and protected CI signing for downloadable outputs; document the distinct trust policies. - [ ] Produce an operator verification/enrollment/recovery runbook and alpha-review evidence showing the exact EFI→boot→rootfs trust chain, public verification keys and download hashes, with no private signing material. - [ ] Design/version a distinct **unsigned user-preference section in `boot.img`**, separate from signed executable/configuration/authority data. Whitelist non-authoritative typed settings, initially keyboard-layout ID; preferences cannot select trust roots, bypass verification, choose executables, alter capability/realm policy or grant device/namespace access. - [ ] Authenticate the container format and section directory/bounds, including the precise permitted unsigned extent. Exclude only that preference payload from the boot signature's authenticated message; verify every security- relevant byte and reject overlap, aliasing, truncation, confused versions and attempts to reinterpret signed bytes as preferences. Give the preference descriptor an authenticated explicit hash policy: no signed section hash may still depend on mutable preference bytes. Any optional corruption checksum for those bytes lives inside their unsigned extent. - [ ] Implement build/read/update tooling for preferences without private signing authority, preserving all authenticated bytes, section extents and signatures. Record separate full-container digest and signed-content identity: preference edits change the former, not the latter; refresh local artifact receipts without falsely claiming an edited image matches published checksums. Coordinate any outer boot-image/catalog authentication so it anchors signed core identity, not a whole-file digest that silently forbids unsigned edits; retain whole-file digests as exact distribution/integrity evidence. - [ ] Parse preferences as bounded untrusted input with deterministic absent/malformed/unsupported-value handling, defaulting keyboard layout to `en_US`. Malformed preference content may fall back, but malformed authenticated structure or signature failure must still fail closed, never enter fallback. - [ ] Carry the validated preference value to its consumers as explicitly non-authoritative data, distinct from trusted clear-completion and authority handoff fields. Only select packaged, signed, allowlisted keyboard definitions; preference text cannot load a script, plugin, arbitrary path or mapping code. - [ ] Add signature/container unit tests and VMs showing layout-only preference edits preserve Secure Boot/boot-content verification, while changing signed code, policy, bounds, key selection or verification flags is rejected. Test integer overflow, unknown/duplicate keys, padding and recovery defaults. - [ ] Version boot-image/handoff parsing and every consumer's trust classification for unsigned preferences; do not reuse `MUTABLE_AFTER_BOOT` or descriptors promising all bytes were signature-verified as an unsigned bypass. Update format/coverage vectors, boot-tool/manual docs and negative version tests together, then retire superseded intake under [Whole-codebase authority and quality audit](https://git.erikinkinen.fi/erix/integration/issues/2) without a permissive fallback. - [ ] Keep the optional boot-logo bitmap and its type/dimensions/format under signed boot-image coverage, separate from unsigned user preferences; decode/render it only after authentication. Logo substitution cannot extend the unsigned region, select executable content or alter authority handoff. ### Consoles, vttys, mouse, TUI and boot logo Weight: 2%; accepted: 0/46. [Owning issue](https://git.erikinkinen.fi/erix/ttyd/issues/1) · [ttyd PR 3](https://git.erikinkinen.fi/erix/ttyd/pulls/3). - [ ] Add strictly boolean `[features].fbcon_clear`, default `true`, to runtime/build configuration, schema, parser, feature identity and documentation; reject malformed values and test omission, true and false. - [ ] Apply the option to early and userspace framebuffer initialization. Clear once before the first console output when enabled; when disabled neither initializer may erase existing content merely because it starts. - [ ] Carry validated framebuffer identity/geometry and an early-clear completion record through the trusted handoff; if early fbcon already cleared the screen, user fbcon adopts it without another clear. Do not treat arbitrary descriptive startup bytes as proof of a trusted completed clear. - [ ] Preserve pixel format/stride/padding, cursor and output continuity; replace conflicting unconditional release/early clears and test that late initialization never erases valid early logs. Normal explicit TUI clearing remains separate from this initialization-only build option. - [ ] Add unit and framebuffer VM coverage for early-only, user-only, both and neither console with clear enabled/disabled; assert exact clear count, final pixels and handoff failure behavior, not just a serial READY marker. - [ ] Set `tty_mirror = false` in both canonical dev/release images; align sample/extended defaults with independent terminals and retain explicit mirrored fixtures so the optional feature remains tested. - [ ] Validate both enabled paths create distinct shells/sessions with separate input/output/cwd/history/foreground jobs/consent and adequate declared capacity; single-path and no-TTY configurations still work without extra grants. - [ ] Preserve frozen [Phase 5 handoff and remaining gates](https://git.erikinkinen.fi/erix/integration/issues/6) timing comparisons as their original cohort, then measure the new dual-shell default separately using [Extensible serial/PS2 CLI input harness](https://git.erikinkinen.fi/erix/integration/issues/5) session-bound observations. Do not attribute a policy/workload change to a kernel speedup or relax the carried limits; report each terminal's full startup/command evidence. - [ ] Specify/version improved fbcond TUI operations: absolute/relative cursor position, visible cursor, erase regions, colors/attributes, rectangular cell updates, scrolling regions, viewport/resize and frame completion. - [ ] Implement bounded validated rendering batches/dirty regions, geometry/capacity checks and deterministic malformed-request behavior without granting raw framebuffer memory or global-screen ownership to clients. - [ ] Expose TUI through session-scoped tty mediation backed by fbcond, with clear renderer versus terminal ownership. Keep trusted powerbox chrome protected; ordinary clients cannot draw over it or steal focus/consent input. - [ ] Implement serial-terminal equivalents or advertised graceful fallbacks over the same session-level interface; define supported capabilities explicitly rather than claiming compatibility with every ncurses extension. - [ ] Extend the shared terminal parser with required cursor/erase/color and alternate-screen behavior, including extop's existing home/full-erase needs; test split escape sequences, unsupported controls and dimensions. - [ ] Port extop to the new TUI interface with efficient frame updates, resize/navigation, screen restoration and interrupt/exit cleanup; retain its exact process-inspection/control authorities and never add broad console caps. - [ ] Implement trusted-prompt suspension/restoration during a TUI session, ensuring modal input is not consumed by extop and no previous trusted text or stale ordinary frame is replayed after focus/session changes. - [ ] Add parser/renderer unit tests and serial/PS2 visual VMs for cursor, erase, colors, scrolling, resize, extop refresh/quit/Ctrl-C, independent TTYs, prompt interruption and complete session/capability cleanup. - [ ] Profile full versus partial redraw, IPC count and extop input-to- frame latency; fix measured bottlenecks without skipping visible completion, and update IPC/Rust API man pages, tool manuals and operator documentation. - [ ] Define keyboard-layout ownership over layout-independent physical key events; retain driver/inputd raw identity and implement text translation at ttyd or a reviewed shared pure layout layer. Provide signed, clean-room `en_US` and `fi_FI` mappings with modifiers, Caps Lock, AltGr, punctuation, Unicode and Finnish dead-key behavior. Keep physical identity, navigation and control chords distinguishable from text. - [ ] Initialize the keyboard text translator from [Signing, rootfs verification and UEFI Secure Boot](https://git.erikinkinen.fi/erix/bootloader/issues/1)'s validated boot preference, default `en_US`; preserve consistent layout behavior for every physical keyboard client/session without double-translating serial input. Initially select layout at boot; later runtime layout changes require their own state-transition contract, not reinterpretation of buffered input. - [ ] Add a git-ignored local build override selecting `fi_FI` and include it explicitly in image identity/test receipts. Keep canonical dev/release, extended profiles and clean CI defaulting to `en_US`; explicit CI layout fixtures test Finnish without allowing a developer override to leak into publication. - [ ] Preserve secure-attention key identity and trusted consent fences; preference changes must not synthesize approval, reinterpret buffered keys or let ordinary layout processing consume trusted y/n plus Enter. Document which chords are physical and which text is layout-selected and display prompts consistently with those rules. - [ ] Add unit/real-input VM tests for both layouts, default/invalid preference fallback, local override isolation, modifier/dead-key release, repeated input, Unicode editor/delete behavior and trusted consent. Test both independent terminals and verify serial byte input remains unchanged. - [ ] Document keyboard selection and preference editing in boot-tool help/man, image/build docs and the technical manual, explicitly identifying unsigned convenience data versus signed security policy and code. - [ ] Replace single-byte-only text emission with checked UTF-8 sequences and backpressure-safe atomic character delivery; define dead-key composition, unsupported combinations, modifier release and pending-state reset on focus/ session/consent changes. Test interrupted multi-byte delivery cannot corrupt commands, leak pending text to another TTY or reinterpret it as trusted input. - [ ] Define multiple framebuffer vttys as distinct live terminal/session generations with their own shell, screen/scrollback, cursor, editing/history, cwd, foreground jobs and input state. Keep virtual-terminal records separate from the existing two physical framebuffer/serial console bindings. - [ ] Specify signed resource/count and creation/retirement policy for configured vttys, with at least two exercised in acceptance. Allocate/reuse only explicitly authorized session resources; an Fn ordinal cannot create processes or grant launch authority. Test exhaustion and safe focus fallback when a shell/vtty exits, without imposing an incidental fixed table limit. - [ ] Implement physical Ctrl+Alt+Fn switching directly to the configured framebuffer vtty identified by Fn. Admit this exact authenticated gesture without a separate manual secure-attention step, independently of keyboard layout; preserve existing trusted controls and reject nonexistent/stale targets. - [ ] Switch display and ordinary input focus atomically by exact live session generation; keep events bound to their receipt-time destination and handle held modifiers/releases without injecting them into the wrong vtty. Independent serial focus remains unchanged; test explicit mirrored mode too. - [ ] Cancel a pending trusted prompt when switching away, retaining the existing cancellation/cleanup contract; never transfer approval state to the destination. Restore ordinary content only after renderer acknowledgement and preserve fresh-input fences if a later prompt is created. - [ ] Retain inactive-vtty output in its own bounded terminal state and restore screen/cursor/selection on activation; handle resize, scrolling and extop alternate-screen updates without exposing another vtty or trusted chrome. - [ ] Add unit and physical-keyboard VMs for direct Fn switching, repeated switching, background output, exit/recreation, stale IDs, modifiers, both layouts, serial isolation and prompt cancellation. Profile switching/memory use and record the multi-vtty workload separately from frozen startup comparisons. - [ ] Implement a framebuffer mouse pointer that starts hidden and becomes visible only on the first authenticated nonzero movement, not button-only, resize or focus events. Define per-seat visibility across vtty switches; distinguish this pointer from the shell's text caret. - [ ] Validate signed deltas, button transitions, geometry and coordinate arithmetic; clip cursor drawing to the viewport and restore underlying pixels correctly during movement, redraw, scrolling, resize and vtty changes. - [ ] Implement left-button press/drag/release text selection and visible highlighting from the owning vtty's ordinary text model, including wrapped lines, Unicode/cell boundaries and scrollback. Bind selection to session and content revision; define updates while output changes during a drag. - [ ] Use conventional primary selection: completing a left-button selection copies its text, and middle-button press pastes it. Keep selection bytes scoped to the owning terminal/session by default; cross-vtty transfer requires explicit user-directed source/destination and realm policy, never a global clipboard or arbitrary screen-reading capability. - [ ] Deliver middle-button paste through the exact destination's ordinary input path with backpressure-safe ordering and no duplicate bytes. Define bracketed-paste/multiline/control-byte behavior so shell paste does not silently execute embedded newlines; require normal explicit submission. Do not apply keyboard layout translation to already selected UTF-8 text. - [ ] Exclude trusted chrome, consent input and other vttys from selection. Mouse selection/paste cannot approve, edit or queue answers to a trusted prompt; reject untrusted escape-sequence clipboard access and keep the host/serial terminal clipboard separate. Retire retained text on owner teardown/reuse. - [ ] Add independent unit and real PS/2 mouse/keyboard tests for initial hiding, button-only packets, first movement, bounds, pixel restoration, selection during redraw/scroll/resize, Unicode, middle paste, backpressure, vtty isolation and prompt races; prove cleanup and zero unintended authority. - [ ] Use [the logo asset](https://git.erikinkinen.fi/erix/docs/src/branch/main/logo_transparent.png) as the original boot-logo source, recording its exact digest and asset provenance. It is currently a 1024×1024 RGBA PNG. Preserve its artwork/transparency; define deterministic preprocessing/scaling rather than generating a new logo. - [ ] Convert the source at build time into a simple, versioned, bounded bitmap payload with explicit dimensions/pixel/alpha format; package it as an optional signed non-executable boot.img section. Keep general PNG decoding out of the bootloader unless a separately justified design requires it. - [ ] In the bootloader, draw the available authenticated bitmap at the screen's bottom center using validated GOP geometry. Preserve aspect ratio, alpha blend against the existing background and define deterministic fitting/ margins for small resolutions; never stretch or draw outside the viewport. - [ ] Fully validate pixel length, width/height/stride, format, arithmetic, alpha and destination bounds before drawing; test RGBA/BGRA, padding, clipping and overflow independently. Image data grants no framebuffer mapping authority. - [ ] Integrate drawing after the configured one-time clear, in both dev and release paths, independent of early text-log enablement. Preserve the clear-completion handoff so later early/user console initialization does not immediately erase the logo; define temporary text/logo placement and normal console takeover without hiding required readiness/error output. - [ ] Boot normally without the optional logo or a usable framebuffer. Define safe cosmetic-error handling for an authenticated but malformed bitmap; container/signature failure still follows the existing fail-closed policy. Release temporary logo buffers/module authority once no consumer needs them. - [ ] Add Linux and in-EriX asset-conversion/package parity tests and put conversion inputs/tools in the [Native tools and full build/packaging pipeline](https://git.erikinkinen.fi/erix/integration/issues/8), [Two-generation self-hosting demonstration](https://git.erikinkinen.fi/erix/integration/issues/9) build closure; the final guest-built images must not depend on an unrecorded host-side bitmap conversion. - [ ] Add bounded visual VM tests for logo present/absent, dev/release, clear true/false, early console on/off, both pixel formats and small/normal geometries; assert bottom-center placement/transparency and unchanged text. Test signed-logo tampering rejection and document the asset/format/build options in boot-tool man pages, canonical docs and the technical manual. ## Alternatives and tradeoffs Detailed design and reproduction evidence stays in the owning issues and PRs so this record can show the whole dependency and acceptance picture. Inventory or specification completion is distinct from runtime acceptance. The imported toolchain policy permits a source-built cross-bootstrap compiler that runs on EriX and uses its runtime interfaces. It requires an in-guest rebuild of the selected upstream Rust/LLVM toolchain and both complete EriX build generations. Implementing an independently owned compiler remains later work; rebuilding upstream tools does not imply clean-room compiler ownership. ## Tracking and rollout Current implementation: signed [lib-ipc PR 2](https://git.erikinkinen.fi/erix/lib-ipc/pulls/2), `aaf2df39700b43507b23ff2007bc0d573c4eea30`, adds the strict child-lifetime binding representation, operation 58 and reason 4, after the [Kernel #19](https://git.erikinkinen.fi/erix/kernel/issues/19) design update. Seven new controls pass all eight strict library/shim configurations: 419 wire and 20 shim tests per configuration, eight freestanding builds, formatting, host/native Clippy and private rustdoc, without warnings. The existing kernel-only shim test remains ignored. Original lib-ipc CI 365/366 passes from four complete logs, 494,246 bytes, no warnings. Signed [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), `54557713f4afad380c1166f6aa1c1622d3959744`, passes 45 tests, two original API exports/regeneration checks, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages with zero final warnings. Original Docs CI 979/980 passes from four complete hashed logs, 773,034 bytes, with 45 tests, the full 2,423-page manual and zero final-pass warnings. Signed [lib-capabi PR 2](https://git.erikinkinen.fi/erix/lib-capabi/pulls/2), fbec4919371603044b9c4dd57a35c10633be314f, aligns the shared dependency ahead of Kernel enforcement; all four strict 192-test configurations and original CI 244/245 pass without warnings (141,078 complete log bytes). The static census passes 3,130 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots. Kernel admission, cohort stopping, safe reclamation progress and coherent consumer adoption remain unimplemented; this shared representation does not enable the operation or alter the prior complete image graph. The prior native lifetime/owned-invocation VM evidence below remains valid for its original sources; no new runtime acceptance is asserted. Original Integration 1681/1682 remains queued and corrected 1675/1676 remains running. Running mediator lifecycle, full source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX-in-EriX build generations remain required. No whole acceptance item is added; completion remains 15/460 and 3.48% weighted. Earlier native terminal checkpoint: signed [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), `a62d1381f56a01afc692112d9b427205eaeb6a2e`, selects signed [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), `37d9c74d6d1209729c520a52a274c1646efe225c`, and reconciles the native diagnostic graph. Shared exit/kill terminal ordering passes four strict 704/728-test Kernel matrices, thirteen native build/Clippy profiles and original Kernel CI 608/609 (four complete logs, 739,870 bytes, no warnings). Both maintained native lifetime and owned-invocation VMs pass unchanged 60-second limits. Packaged artifacts match their original outputs, all fifteen component signatures verify, and four current strict 320/321-test Integration matrices pass without warnings. Seven focused checks pass; full 169-helper evidence remains bound to unchanged orchestration bytes. Original Integration CI 1681/1682 is queued; corrected 1675/1676 remains running. [Kernel design #19](https://git.erikinkinen.fi/erix/kernel/issues/19) tracks child cleanup after supervisor loss; only its terminal-refactor prerequisite is implemented. Native binding, safe reclamation progress, running mediator lifecycle, full frame proof, upstream toolchain rebuilding and both complete EriX builds remain open. Static census passes 3,128 authored code files below 1,000 lines and existing pin/lint gates. No whole phase item is newly accepted. Earlier guarded-preparation checkpoint: signed [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), `b65183ddb93eb4396d4140a002c3727fec42ff87`, selects [Exsh PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3), `ffe50612889dd58a45a40d04593a4aa3a3ffa512`, for the guarded-preparation VM, now also selecting signed Kernel `b762e19d0c16acd605d0f6123994a586cc6fcde1` and the reconciled manual. [Kernel issue 18](https://git.erikinkinen.fi/erix/kernel/issues/18) and [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) track the bounded census failure-policy correction: hosted controls, four strict matrices and thirteen native build/Clippy profiles pass, as do original Kernel CI 606/607 with four complete warning-free logs (739,843 bytes). The actual matching consumer VM passes without warnings; normal bootstrap does not establish reachability of the hosted injected condition. The eleven admission calls and five preparation/retirement calls pass through the existing private route using one explicitly supplied cwd SEND copy. The staged native fixture remains unstarted. Both unique diagnostic markers precede ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 appliance artifacts and complete logs are retained; all 73 original component revisions, actual diagnostic executable and signed startup configuration are verified without warnings. All 169 helpers, seventeen route controls, four strict 320/321-test Integration configurations and ten strict 976-test Exsh configurations pass. Eight actual shell frame observations remain incomplete. Original Integration CI 1679/1680 and 1677/1678 are queued; earlier corrected 1675/1676 is running. Catalog adoption preserves all previously checked implementation bytes, with focused source checks passing. An initial Git fixture environment failure is retained alongside its corrected-environment result. Static census passes 3,127 authored code files below 1,000 lines and the existing pin/lint gates. Original Exsh CI 271/272 fails full frame proof despite passing all 976 Rust tests and 355 checker controls; all four logs are complete (320,166 bytes) without warnings, with 101/68 unresolved runtime/all observations. Signed [Posixd documentation](https://git.erikinkinen.fi/erix/posixd/pulls/5), `9b031a8c2f996491a322046a4f2acd5dacdc55c2`, corrects stale producer-custody and endpoint narrowing claims; original CI 17/18 passes with complete warning-free logs. Signed [manual correction](https://git.erikinkinen.fi/erix/docs/pulls/4), `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, passes 45 tests, the full 2,419-page build, all 445,847 word bounds and visual review of three changed pages, with zero final warnings; original Docs CI 977/978 passes from four complete hashed logs (772,186 bytes), including 45 tests, the full manual and zero final-pass warnings. Launchd 143 passes, while 144 fails Markdown with an unavailable HTTP-500 job log; its cause remains unclassified. The separately passing Rust log is retained. [Launchd PR 2](https://git.erikinkinen.fi/erix/launchd/pulls/2) and [Procd PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) retain the original staging and custody contracts. Typed mediator execution, readiness/configuration/sealing, real client I/O, full source/effect/frame proof, native upstream Rust/LLVM rebuilding and both complete EriX builds remain open. No whole checklist item is newly accepted. Next prerequisite: the signed [minimum-bootstrap proposal](https://git.erikinkinen.fi/erix/posixd/src/commit/3e6292bd3e5c6a3e59dbae54124f8eea52141957/docs/minimum-bootstrap.md) defines private route ownership, counted startup requirements and independently authenticated readiness. It requires a surviving child-termination owner after Procd loss before any private execution gate opens; SEND revocation alone does not prove child destruction. Original Posixd CI 19/20 passes from both complete warning-free logs (7,212 bytes). No new runtime or wire ABI is assigned. Update this issue after each accepted implementation checkpoint, changed requirement, significant regression, PR transition or terminal CI classification. Reconcile every checkbox, the 460-item denominator, section weights, completion percentage and links; preserve historical failures and human edits. Add new requirements explicitly and explain denominator changes instead of deleting unfinished work. Every changed repository needs its linked WIP PR and current owning issue; every significant non-security bug/regression needs a canonical bug report with exact identity, reproduction, constraints and evidence. The implementation order is dependency-led: coherent original sources and authority primitives; complete realm/bootstrap/configuration/seal/client lifecycle; POSIX substrate and imported tools; native guest build/packaging; two full self-hosted generations; final full-codebase, documentation and original CI closure. Supplementary trust-chain, real-input and interface requirements remain part of final acceptance throughout. Current review: [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), [Launchd PR 2](https://git.erikinkinen.fi/erix/launchd/pulls/2), [Procd PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2), [Rootd PR 2](https://git.erikinkinen.fi/erix/rootd/pulls/2), [Exsh PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3), [manual PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). The owning-issue links above contain the remaining repository and dependency review links. Current regressions and evidence gaps include [ext4 quota timeout](https://git.erikinkinen.fi/erix/integration/issues/18), [full layout/source/frame closure](https://git.erikinkinen.fi/erix/integration/issues/57) and [exact-selector input observation](https://git.erikinkinen.fi/erix/integration/issues/64). Original Integration 1671/1672 has completed with filesystem VM failures; its complete classification is retained below. The corrected host-directory fixture in issue 63 is closed after its focused tests and both original helper steps pass. These links are examples of open gates, not an exhaustive substitute for each owning audit. Successful completion establishes the technical baseline for `v1.0.0-alpha.1`. Promotion of images, PR readiness, merges, tags and release publication still require their applicable explicit review/approval; this checklist does not provide release authorization. Signed reproducer — 19 September 2026: Integration `76411ed6d96356b20ee0a4c21ad219dacc56340d` publishes the explicit scenario and selector. With the documented image signing inputs, run `bash scripts/run-scenario.sh tests/scenarios/appliance-disk-image-realm-admission-positive.toml components.toml`. The original failed runtime uses the same scenario, implementation and component graph; only roadmap status changed after validation. Its VM result remains FAIL. All 169 helpers and four strict Rust configurations pass without warnings. Original [CI 1673](https://git.erikinkinen.fi/erix/integration/actions/runs/1673) and [1674](https://git.erikinkinen.fi/erix/integration/actions/runs/1674) are queued. [Issue 66](https://git.erikinkinen.fi/erix/integration/issues/66) retains the failure. No acceptance credit or complete realm execution is claimed. Original CI observation — 19 September 2026: [CI 1671](https://git.erikinkinen.fi/erix/integration/actions/runs/1671) finishes with 471 passes/16 failures and [CI 1672](https://git.erikinkinen.fi/erix/integration/actions/runs/1672) with 465 passes/22 failures across all 487 scenarios at `c479813423fb71c606fa30e5cf7d4dfb16f557d0`. Every failed scenario is an ext3/ext4 positive filesystem case reporting `error: qemu timed out after 120s`, with scenario status 1. The existing [filesystem deadline report](https://git.erikinkinen.fi/erix/integration/issues/20) retains the expanded matrix; [quota issue 18](https://git.erikinkinen.fi/erix/integration/issues/18) applies to the quota failure in 1672. All six complete logs are hashed (41,592,478 bytes), with zero warning candidates. Rust, Markdown and the full helper step pass. The zero-realm startup and exact-selector race scenarios explicitly pass in both runs. No common cause, source regression boundary or performance diagnosis is inferred; all actual deadlines and failure statuses remain unchanged, and neither workflow was rerun. Original corrected-source CI checkpoint — 19 September 2026: at signed Integration 9139c6c5fa38c139e92520f6d410626b4cf1e4aa, original [push CI 1675](https://git.erikinkinen.fi/erix/integration/actions/runs/1675) passes all 488 VM scenarios. Original [PR CI 1676](https://git.erikinkinen.fi/erix/integration/actions/runs/1676) passes 487/488 and fails only `subsystem-e2fs-fat-ext3-htree-positive` at the unchanged 120-second QEMU limit. Both pass `appliance-disk-image-realm-admission-positive`; both Rust and Markdown jobs pass. Six complete hashed logs contain 27,276,890 bytes and no warnings. No rerun or cancellation supplies either result. The ext3 timeout remains tracked in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20); its cause is not inferred from the passing sibling run. The private script-route admission defect is corrected and natively demonstrated, while full realm lifecycle, complete frame proof and guest builds remain open. Native child lifetime checkpoint — 19 September 2026: signed Kernel 1428885e6d27e8e2bcefbbf68caf22ece253aac9 implements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original [Kernel CI 610](https://git.erikinkinen.fi/erix/kernel/actions/runs/610) and [611](https://git.erikinkinen.fi/erix/kernel/actions/runs/611) pass from four complete hashed logs, 751,929 bytes, without warnings. The matching maintained lifetime VM passes its original 60-second scenario with the additional `ERIX_KERNEL:CHILD_LIFETIME_OK` marker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is `012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572`. This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added. Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original [Docs CI 981](https://git.erikinkinen.fi/erix/docs/actions/runs/981) and [982](https://git.erikinkinen.fi/erix/docs/actions/runs/982) pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled. Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original [Integration CI 1683](https://git.erikinkinen.fi/erix/integration/actions/runs/1683) and [1684](https://git.erikinkinen.fi/erix/integration/actions/runs/1684) are queued. Static census: 3,136 authored code files are below 1,000 physical lines. All 74 manifests and 259 full Git selections pass the current policy check; 171 direct missing_docs gates and all 92 conventional crate roots are present. This is not semantic authority or complete private-rustdoc closure. Acceptance remains 15/460 and 3.48% weighted. Executing-child and terminal-reply checkpoint — 19 September 2026: signed [Kernel dd9eace5](https://git.erikinkinen.fi/erix/kernel/commit/dd9eace5b52edc02e624f142e92b85032f59bace) validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for `ERIX_KERNEL:CHILD_EXECUTION_OK`. Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed [Integration c14c5a61](https://git.erikinkinen.fi/erix/integration/commit/c14c5a617196a9b135b479601ca47a21371a9482) requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is `1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f`. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes. Signed [Docs b4b01d87](https://git.erikinkinen.fi/erix/docs/commit/b4b01d870757d9b626dd2cfa7c6424332087bf62) documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged. This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives `GRANT | MINT` while binding needs only `GRANT`; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related implementation tracking: [Kernel feature](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original [Kernel CI 614](https://git.erikinkinen.fi/erix/kernel/actions/runs/614) and [615](https://git.erikinkinen.fi/erix/kernel/actions/runs/615) pass from four complete hashed logs, 753,462 bytes, without warnings. Original [Docs CI 983](https://git.erikinkinen.fi/erix/docs/actions/runs/983) and [984](https://git.erikinkinen.fi/erix/docs/actions/runs/984) pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation. Older original [Integration CI 1678](https://git.erikinkinen.fi/erix/integration/actions/runs/1678) passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is [issue 67](https://git.erikinkinen.fi/erix/integration/issues/67), with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun. Native cleanup without a userspace successor — 19 September 2026: signed [Kernel 2cf5b34c](https://git.erikinkinen.fi/erix/kernel/commit/2cf5b34c77451e4ddfa50f6bab9ae65cc5c47068) adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor. A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt. `ERIX_KERNEL:CHILD_IDLE_CLEANUP_OK` precedes completion before HLT, so actual hardware halt/wakeup remains a separate gate. Signed [Integration 4d6f4fe8](https://git.erikinkinen.fi/erix/integration/commit/4d6f4fe8b383603b225b04a7771a11f32886e0a9) requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256: `4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c`. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status. Signed [Docs 69466a64](https://git.erikinkinen.fi/erix/docs/commit/69466a64c032d575569adeff14f17a445e5a9c03) documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open. Original [Kernel CI 616](https://git.erikinkinen.fi/erix/kernel/actions/runs/616) and [617](https://git.erikinkinen.fi/erix/kernel/actions/runs/617) pass from four complete hashed logs, 753,458 bytes, with no warnings. Original [Docs CI 985](https://git.erikinkinen.fi/erix/docs/actions/runs/985) and [986](https://git.erikinkinen.fi/erix/docs/actions/runs/986) also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation. Older original [Integration CI 1677](https://git.erikinkinen.fi/erix/integration/actions/runs/1677) is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; [bug 37](https://git.erikinkinen.fi/erix/integration/issues/37) retains this evidence. Companion 1678's earlier development COM1 failure remains separate in [bug 67](https://git.erikinkinen.fi/erix/integration/issues/67); a common cause is unproven. No original workflow was cancelled or rerun. Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Further original CI observations — 19 September 2026: original Integration `b65183ddb93eb4396d4140a002c3727fec42ff87` now has both terminal outcomes recorded. [Run 1679](https://git.erikinkinen.fi/erix/integration/actions/runs/1679) passes 488/489 catalog cases; only ext4 quota exceeds its unchanged 120-second deadline, retained in [bug 18](https://git.erikinkinen.fi/erix/integration/issues/18). Its later native/interactive gates are not reached. [Run 1680](https://git.erikinkinen.fi/erix/integration/actions/runs/1680) passes all 489 catalog cases and both native diagnostics, then fails development COM1 directory input after its physical counterpart passes; the last observation is command 6 injection, retained in [bug 56](https://git.erikinkinen.fi/erix/integration/issues/56). Later release directory/editor gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,238,688 bytes with zero warning candidates. Causes remain unclassified; no unchanged rerun, cancellation or deadline change occurred. Original current Integration 1687/1688 remains queued at its second observation. Acceptance stays 15/460, 3.48% weighted; native toolchain rebuilding and both full EriX-in-EriX generations remain open. Native terminal-event allocation refusal — 19 September 2026: signed [Kernel ba03995f](https://git.erikinkinen.fi/erix/kernel/commit/ba03995fe0dcfc3d4a1f72eb000e0c7698bbcbaa) extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect. Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required. `ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OK` requires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice. Signed [Integration cf5b2f5f](https://git.erikinkinen.fi/erix/integration/commit/cf5b2f5f1d63631e69df3074d7c1c0b9b4921480) requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9`. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 62ba2ffa](https://git.erikinkinen.fi/erix/docs/commit/62ba2ffa30ff9f04840c8d38d188b414e5b24b90) passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open. Original [Kernel CI 618](https://git.erikinkinen.fi/erix/kernel/actions/runs/618) and [619](https://git.erikinkinen.fi/erix/kernel/actions/runs/619) pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original [Docs CI 987](https://git.erikinkinen.fi/erix/docs/actions/runs/987) and [988](https://git.erikinkinen.fi/erix/docs/actions/runs/988) pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun. The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Historical pre-correction CI reconciliation — 19 September 2026: original [Integration run 1673](https://git.erikinkinen.fi/erix/integration/actions/runs/1673) and [1674](https://git.erikinkinen.fi/erix/integration/actions/runs/1674), at `76411ed6d96356b20ee0a4c21ad219dacc56340d`, are terminal failures. Each passes 487/488 catalog scenarios and fails only `appliance-disk-image-realm-admission-positive`, reporting the unchanged 45-second serial-progress watchdog. Later native and interactive workflow gates are not reached. Both Rust and Markdown jobs pass. Six complete hashed logs total 27,087,569 bytes with zero warning candidates. Neither workflow was cancelled or rerun. These runs precede the retained correction at `9139c6c5fa38c139e92520f6d410626b4cf1e4aa`; both later original runs 1675/1676 passed that realm-admission scenario. [Issue 66](https://git.erikinkinen.fi/erix/integration/issues/66) retains the historical evidence and its existing closed state. This does not establish a new current-source regression, full lifecycle acceptance or full guest builds. Current Integration 1689/1690 remains queued at its second observation; acceptance stays 15/460, 3.48% weighted. Independent native child release recovery — 19 September 2026: signed [Kernel 82d88b60](https://git.erikinkinen.fi/erix/kernel/commit/82d88b609bd808a840780993da315230dd14399a) extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal. The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass. `ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OK` requires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required. Signed [Integration 294a467a](https://git.erikinkinen.fi/erix/integration/commit/294a467a3bcd9464ea55c32dbce98acf19d0e400) requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is `606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08`. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status. Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed [Docs 2a0ccc1a](https://git.erikinkinen.fi/erix/docs/commit/2a0ccc1a595c3e03aa6c7b7ecbcaca8830082ddd) passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open. Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged. The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted. Related: [Kernel design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12), [manual WIP PR](https://git.erikinkinen.fi/erix/docs/pulls/4), and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Explicit install-grant authority design — 19 September 2026: creation and derivation will request the returned grant capability's own rights explicitly, independently of its child slot/type/installed-rights ceiling. The native constructor must stop unconditionally adding GRANT | MINT. Zero means exactly zero rights; it never means inheritance. Only known rights valid for INSTALL_GRANT are admitted. Derivation still requires actual MINT authority and may request only a subset of the source grant's own rights and installation scope. A MINT-only source cannot recreate GRANT that it no longer holds. Genuine multilevel derivation remains possible through an explicitly delegating result. The coordinated scalar layout uses the low/high halves of arg0 for grant slot/own rights on creation selectors 32 and 54, and source grant slot/result own rights on derivation selector 33. Other creation and derivation fields keep their existing meaning. A checked shared derivation representation will reject other selectors and reserved flags/high destination bits. Root-capability-free creation will expose the own-rights field alongside its existing explicit optional VSpace receipt. Existing zero high halves receive no compatibility default or implicit authority. Every actual emitter must be updated in the coherent original revision graph; no fallback to an older selector or looser receipt check is allowed. Rootd and Procd will request MINT only for creation paths that actually derive installers. Procd's mediator creation and final installer handoffs will request GRANT without MINT; Procd and Launchd must independently validate actual capability/receipt rights rather than trusting request metadata. Native transfer remains move-only, preserves exact original scope and rights, and neither duplicates nor withdraws cleanup duty. Failed or lost creation/derivation replies must retain the original child generation and existing one-way rollback obligations. A zero-right grant still has its original record and must be dropped before start if it is no longer needed. Required controls include exact zero/GRANT/MINT/GRANT | MINT requests; malformed/unknown/excess rights with no publication; ordinary installation and lifetime binding from GRANT-only authority; denial of further derivation without MINT; explicitly permitted narrower multilevel derivation; exact move receipts; preservation of source identity, generation and scope; occupied destinations and failure cleanup; and actual CPL3 coverage alongside all existing native allocation/release/idle assertions. Update actual consumers and their tests, the native policy, component architecture/roadmaps and the manual. Run warning-denied formatting, strict Clippy, unit and native tests, full manual checks and original CI; retain all pre-existing full lifecycle/frame/Pagerd/toolchain/guest-build acceptance gates. This design earns no completed acceptance leaf. Owning coordination: [Kernel lifetime design](https://git.erikinkinen.fi/erix/kernel/issues/19), [Kernel WIP PR](https://git.erikinkinen.fi/erix/kernel/pulls/3), [Integration WIP PR](https://git.erikinkinen.fi/erix/integration/pulls/12) and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Explicit grant implementation progress — 20 September 2026: Kernel commit [4a5333f760e258ebca23047a362d1cff4fded0c0](https://git.erikinkinen.fi/erix/kernel/commit/4a5333f760e258ebca23047a362d1cff4fded0c0) is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending. Integration commit [9166f7bde6a0b42afd3ef1c9898b9e818df9af86](https://git.erikinkinen.fi/erix/integration/commit/9166f7bde6a0b42afd3ef1c9898b9e818df9af86) is a signed orchestration-library dependency checkpoint. Four strict 320/321-unit configurations and four native library builds pass without warnings. Original CI 1693/1694 is waiting at its first observation. The full image catalogs still retain their preceding coordinated selection until actual consumers are validated together. Shared wire and dependency checkpoints, each with strict matrices and original CI passing: [lib-ipc issue/PR](https://git.erikinkinen.fi/erix/lib-ipc/issues/1), [lib-capabi issue/PR](https://git.erikinkinen.fi/erix/lib-capabi/issues/1), [lib-bootstrap issue/PR](https://git.erikinkinen.fi/erix/lib-bootstrap/issues/1), [lib-interrupt issue/PR](https://git.erikinkinen.fi/erix/lib-interrupt/issues/1), [lib-service issue/PR](https://git.erikinkinen.fi/erix/lib-service/issues/1), [lib-time issue/PR](https://git.erikinkinen.fi/erix/lib-time/issues/1), [lib-block issue/PR](https://git.erikinkinen.fi/erix/lib-block/issues/1), [lib-log issue/PR](https://git.erikinkinen.fi/erix/lib-log/issues/1), [lib-driver issue/PR](https://git.erikinkinen.fi/erix/lib-driver/issues/1), [lib-vfs issue/PR](https://git.erikinkinen.fi/erix/lib-vfs/issues/1). Their linked WIP PRs retain the detailed signed revisions and validation. The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. [Deviced bug 4](https://git.erikinkinen.fi/erix/deviced/issues/4) records a separately observed quarantine test race and its test-only serialization correction. This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required. Verified grant-rights checkpoint — 20 September 2026: Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 `6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a`; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build. All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. [Rootd baseline regression](https://git.erikinkinen.fi/erix/rootd/issues/6) and [Deviced quarantine fixture race](https://git.erikinkinen.fi/erix/deviced/issues/4) are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress. [Integration bug 68](https://git.erikinkinen.fi/erix/integration/issues/68) records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis. Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Manual and dependency validation — 20 September 2026: Docs commit [f4621ce2921b2b9fe3b1d25b4321d6b28289418e](https://git.erikinkinen.fi/erix/docs/commit/f4621ce2921b2b9fe3b1d25b4321d6b28289418e) is signed and pushed. Native selectors 32/33/54 now document exact own rights separately from installation ceilings. The process and launch chapters require GRANT-only final receipts, explicit derivation/source disposal, and original-generation rollback. Both IPC references are regenerated from signed source. All 45 tests and API checks pass; the complete 2,429-page manual has zero final warnings, all 448,913 word bounds pass, and eleven changed pages were visually reviewed. Original Docs CI 991/992 passes with four complete hashed logs, 774,346 bytes, both 45-test runs and final 2,429-page manuals. Intermediate TeX reference warnings resolve before the final pass. Thirty-one additional downstream consumers now have signed dependency-alignment checkpoints, each with four strict unit configurations, four native builds, host/native Clippy, formatting and private rustdoc passing without warnings. All 62 original CI runs pass. Their owning feature issues and WIP PRs retain exact revisions and log evidence. [Catalog regression 68](https://git.erikinkinen.fi/erix/integration/issues/68) remains open until the remaining Exsh selection and complete original catalog are validated together. Individual repository success is not full service-image acceptance. Exsh's default development tests pass 976 units. Aggregate release-test compilation and a subsequent explicitly separated library compilation each reached the local unchanged 120-second silence limit before tests ran; both failures remain retained. No release-test success is inferred, no compiler setting or deadline was relaxed, and independent configurations are being collected without rerunning failed commands unchanged. The complete source/effect/frame gate also remains open. Original Integration 1693/1694 also fails with 127 manifest/catalog mismatches each, before full VM execution. Six complete logs total 604,756 bytes, with no warning candidates. Together with 1683–1692 this is twelve retained original failing runs. Earlier full-VM filesystem timeouts remain separately tracked in [ext-family issue 20](https://git.erikinkinen.fi/erix/integration/issues/20) and [FAT32 issue 58](https://git.erikinkinen.fi/erix/integration/issues/58). Canonical acceptance remains 15/460 leaves, 3.48% weighted. Full service lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required. Static audit currently passes 3,150 authored code files below 1,000 lines, 74 manifests, 259 explicit Git pins, 172 direct missing_docs gates and 92 conventional Rust roots; full semantic authority and documentation review remain open. Complete original catalog checkpoint — 20 September 2026: Integration [f9681efc30f1c48989def7f0e7db939974a30e27](https://git.erikinkinen.fi/erix/integration/commit/f9681efc30f1c48989def7f0e7db939974a30e27) is signed and pushed in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Both complete catalogs now pass exact dependency equality against 73/70 clean original selected checkouts and 72/71 manifests; all 143 selected signatures verify. The original Integration library pin is retained independently of the catalog commit, avoiding a circular source reference. Twenty dependency-policy and 46 immutable-source tests, both native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Corrected-source original CI 1695/1696 is running; [bug 68](https://git.erikinkinen.fi/erix/integration/issues/68) remains open pending that observation and full consumer acceptance remains separate. The executed inputs for both first-attempt native VM passes remain exact: 27 new ordinary CPL3 grant-right controls, every earlier lifetime/owned-invocation assertion, original 60-second bounds, zero build warnings and empty QEMU stderr. Both packaged kernels match retained original artifacts and all fifteen original source signatures verify. The final post-VM changes only select the full catalogs and reconcile documentation. All 31 further fully validated consumer checkpoints pass four strict unit/native configurations and all 62 original CI runs; 124 complete logs total 3,041,213 bytes with no warning candidates. Their owning feature issues and WIP PRs preserve exact source and CI evidence. The full manual and regenerated IPC references are published in [Docs WIP PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4); its 45 tests, 2,429 pages, 448,913 word bounds and eleven changed-page reviews pass, as do original Docs CI 991/992 with zero final warnings. Exsh [dbc958bcdaa557a461e9308a31d23d3b8c189296](https://git.erikinkinen.fi/erix/exsh/commit/dbc958bcdaa557a461e9308a31d23d3b8c189296) in [WIP PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3) is explicitly an incomplete-validation dependency checkpoint. Both development configurations pass 976 units, four native builds and strict Clippy/docs configurations pass, and all 355 checker tests pass. Three local release-unit compilation attempts reached the unchanged 120-second silence bound before tests ran. Four local frame checks return 1 with complete workspace mapping and 97/63 unresolved routes. Original CI 273/274 likewise passes 976 units and 355 checker tests, then fails the full frame/source gate with 101/68 unresolved observations. Four complete CI logs total 319,871 bytes with zero warning candidates. These local and CI artifacts are distinct; no frame or release-unit acceptance, relaxed deadline or unchanged retry is claimed. Canonical acceptance remains 15/460 leaves, 3.48% weighted. The full in-EriX builds and native external Rust/LLVM/runtime rebuild remain unproven. Full consumer lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate and profiler attribution remain required; no canonical leaf closes at this checkpoint. Installer return-slot regression — 21 September 2026: Both original corrected-catalog runs are now classified: [1695](https://git.erikinkinen.fi/erix/integration/actions/runs/1695) passes 431/489 VM scenarios and [1696](https://git.erikinkinen.fi/erix/integration/actions/runs/1696) passes 430/489. All six complete logs are retained and hashed, 32,723,390 bytes, zero warning candidates. Rust, Markdown and full dependency equality pass. Catalog mismatch [issue 68](https://git.erikinkinen.fi/erix/integration/issues/68) is corrected; this does not establish full consumer acceptance. Each run has 57 initial-shell uncertain-disposition failures and a separately retained release-appliance stall. Run 1696 also retains the ext4 quota timeout under its original 120-second bound, tracked in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20). [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) records a concrete producer/consumer mismatch. The final installer was handed off from VSpace scratch slot 1056 while later TTY provisioning requires managed grant slot 1040. The added producer regression fails on the original code. Signed Procd [10d972b652297fd656e9a6ac6dbdf197f362c7ce](https://git.erikinkinen.fi/erix/procd/commit/10d972b652297fd656e9a6ac6dbdf197f362c7ce) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) derives the exact GRANT-only result, disposes its delegating source and uniquely relocates the result back to the empty managed grant slot. Refusals preserve original-stage rollback and remaining custody. Four strict 291/296-unit configurations, four native builds, host/native Clippy, formatting, private rustdoc and policies pass with zero warnings. Corrected full-service VM validation and original CI remain open; bug 4 remains open. Acceptance remains 15/460 leaves, 3.48% weighted. Full consumer lifecycle, terminal accounting, source/effect/frame proof, Pagerd, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full in-EriX build generations remain required. Verified managed installer recovery — 21 September 2026: Signed Integration [648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d](https://git.erikinkinen.fi/erix/integration/commit/648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d) in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) selects signed Procd [ac8a12993bc8cbf134a11e141e459cb63df71123](https://git.erikinkinen.fi/erix/procd/commit/ac8a12993bc8cbf134a11e141e459cb63df71123) and [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4). Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed. [Procd bug 4](https://git.erikinkinen.fi/erix/procd/issues/4) is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings. The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes. The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged. Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open. Acknowledged terminal accounting — 21 September 2026: [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20) specifies final scalar CPU evidence retained independently of native resource reclamation, repeatable observations bound to actual original observer generations, independent authorized observers, exact acknowledgement and claim release on observer death. Both ordinary and mediator consumers must commit terminal measurements and cleanup duties before acknowledgement, including consumer-loss handling. Shared wire commit [0b889095fd04f6f4b1da1d4c0064150551f52122](https://git.erikinkinen.fi/erix/lib-ipc/commit/0b889095fd04f6f4b1da1d4c0064150551f52122) is signed and pushed. Four wire configurations pass 427 tests each; four syscall-shim configurations pass 20 each with one existing ignore. Eight native builds, strict host/native Clippy, formatting, private rustdoc, Markdown and dependency checks pass without warnings. Native kernel and consumer adoption, actual CPL3/service VM acceptance and original CI observation remain open. Canonical completion remains **3.48% weighted; 15 of 460 acceptance items**. Full upstream Rust/LLVM/runtime rebuilding inside EriX remains mandatory together with both full EriX guest build generations. No acceptance item closes from this representation checkpoint. Verified native terminal accounting — 21 September 2026: Kernel [a9bdf6163813d378e0b4a164bceb839e24fbb6b7](https://git.erikinkinen.fi/erix/kernel/commit/a9bdf6163813d378e0b4a164bceb839e24fbb6b7) is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback. Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings. Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256 `921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9`); owned invocation retains 1,587 (SHA256 `404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907`). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify. [Kernel regression 21](https://git.erikinkinen.fi/erix/kernel/issues/21) retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred. Integration [fcd7b4a9608f629a12de78c53da5c3615d906b46](https://git.erikinkinen.fi/erix/integration/commit/fcd7b4a9608f629a12de78c53da5c3615d906b46) is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation. Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). Canonical acceptance remains **3.48% weighted; 15 of 460 items**. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven. Committed terminal-accounting consumers — 21 September 2026: Procd [66934642c4464fc738152a9e60790914ba27dd1c](https://git.erikinkinen.fi/erix/procd/commit/66934642c4464fc738152a9e60790914ba27dd1c) in [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2) reserves notification/crash/cleanup storage before effects, obtains exact final CPU evidence, commits local status and cleanup obligations, then acknowledges on every actual event polling path. Lost acknowledgement replies preserve the local result without duplicate counters or notifications. Mediators retain only scalar counters and the original authenticated supervisor identity after disposing all capability columns; supervisor death discharges the pending scalar observation and a replacement cannot inherit it. Four strict 299/305-test configurations, native builds, Clippy and private rustdoc pass. Original CI [298](https://git.erikinkinen.fi/erix/procd/actions/runs/298)/[299](https://git.erikinkinen.fi/erix/procd/actions/runs/299) passes from four complete hashed logs, 347,245 bytes, zero warnings. [Bug 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open for actual service acceptance. Rootd [64c97b13c450003d9c2b6bd9ed2a627088684b46](https://git.erikinkinen.fi/erix/rootd/commit/64c97b13c450003d9c2b6bd9ed2a627088684b46) in [WIP PR 2](https://git.erikinkinen.fi/erix/rootd/pulls/2) acknowledges bootstrap evidence only after exact native destruction and local endpoint absence; both operations remain unavailable after temporary Process custody transfers to Procd. Four strict 430/429-test configurations, native builds, Clippy and private rustdoc pass. Original 1039/1040 exposed [bug 7](https://git.erikinkinen.fi/erix/rootd/issues/7): a stale source-call inventory and its matching semantic operation declarations. The correction explicitly inventories acknowledgement consumers and preserves the same temporary route and eventual Procd owner. All 64 Python controls, production-boundary, semantic baseline, threat model, phase contract and operation-ownership gates pass. Corrected original CI [1041](https://git.erikinkinen.fi/erix/rootd/actions/runs/1041)/[1042](https://git.erikinkinen.fi/erix/rootd/actions/runs/1042) passes from four complete verified logs, 222,969 bytes, zero warnings. Bug 7 is corrected; failed original runs remain retained without reruns or weaker gates. Docs [e4525848ad4462901c9a6794ef1794cf85ea9e6b](https://git.erikinkinen.fi/erix/docs/commit/e4525848ad4462901c9a6794ef1794cf85ea9e6b) updates the native contract, Procd/Rootd consumer custody and original signed IPC API references. Selector 55 is retired in both the detailed contract and summary; 58/59/60 are cross-checked against the shared registry. All 45 documentation tests and generated-reference checks pass. The complete 2,431-page manual builds without warnings; changed prose, selector and API pages pass visual review. Original documentation CI [995](https://git.erikinkinen.fi/erix/docs/actions/runs/995)/[996](https://git.erikinkinen.fi/erix/docs/actions/runs/996) and corrected-table [997](https://git.erikinkinen.fi/erix/docs/actions/runs/997)/[998](https://git.erikinkinen.fi/erix/docs/actions/runs/998) passes from eight complete logs, 1,549,628 bytes, with zero warnings in the final LaTeX passes. The 37 earlier convergence candidates per manual log are retained and resolved. The separate Integration orchestration library checkpoint [b06dfad00202765491a64552dde29eaca1c24838](https://git.erikinkinen.fi/erix/integration/commit/b06dfad00202765491a64552dde29eaca1c24838) passes four strict 320/321-test host/native configurations. Full service catalogs remain on their prior coherent graph while 35 remaining application/service repositories adopt the original shared revisions. Integration 1697/1698 remains running, and 1699/1700 plus 1701/1702 waits at the latest bounded observations. These are pending full regressions, not successful runtime acceptance. No new canonical acceptance leaf is closed: 15/460 and 3.48% weighted. Ordinary Launchd metric-consumer restart/disposal semantics, coherent service CPU/profiler VMs, complete realm/provider authority and I/O, source/effect/frame proof, Pagerd, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. The static audit finds 3,162 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and 92 conventional crate roots; this does not establish semantic authority or complete private-documentation closure. Twelve shared dependency libraries pass all four strict host/native configurations and 24 original CI runs, with 48 complete verified logs totaling 620,122 bytes and zero warnings. Owning issues and WIP PRs are synchronized. The signed original checkpoints are: | Component tracking | Revision | Passing original CI | | --- | --- | --- | | [lib-bootstrap issue](https://git.erikinkinen.fi/erix/lib-bootstrap/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-bootstrap/pulls/2) | [8110627a6723](https://git.erikinkinen.fi/erix/lib-bootstrap/commit/8110627a67238183b65873dc9d25b4bf51fdd8a7) | [157](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/157)/[158](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/158) | | [lib-block issue](https://git.erikinkinen.fi/erix/lib-block/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-block/pulls/2) | [40fcbe0d568c](https://git.erikinkinen.fi/erix/lib-block/commit/40fcbe0d568c54288b44c0c30034406279533168) | [47](https://git.erikinkinen.fi/erix/lib-block/actions/runs/47)/[48](https://git.erikinkinen.fi/erix/lib-block/actions/runs/48) | | [lib-interrupt issue](https://git.erikinkinen.fi/erix/lib-interrupt/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-interrupt/pulls/2) | [09a9de168bd8](https://git.erikinkinen.fi/erix/lib-interrupt/commit/09a9de168bd85fb5a117b055961fe919f23debd4) | [60](https://git.erikinkinen.fi/erix/lib-interrupt/actions/runs/60)/[61](https://git.erikinkinen.fi/erix/lib-interrupt/actions/runs/61) | | [lib-log issue](https://git.erikinkinen.fi/erix/lib-log/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-log/pulls/2) | [1b4e0dda15d5](https://git.erikinkinen.fi/erix/lib-log/commit/1b4e0dda15d5cd5dc0d6ea991438b5680d5a3473) | [67](https://git.erikinkinen.fi/erix/lib-log/actions/runs/67)/[68](https://git.erikinkinen.fi/erix/lib-log/actions/runs/68) | | [lib-service issue](https://git.erikinkinen.fi/erix/lib-service/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-service/pulls/2) | [9b280b903277](https://git.erikinkinen.fi/erix/lib-service/commit/9b280b90327713d817e5df75c1d83a44e1dcdbb3) | [85](https://git.erikinkinen.fi/erix/lib-service/actions/runs/85)/[86](https://git.erikinkinen.fi/erix/lib-service/actions/runs/86) | | [lib-time issue](https://git.erikinkinen.fi/erix/lib-time/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-time/pulls/2) | [cdf323ee1804](https://git.erikinkinen.fi/erix/lib-time/commit/cdf323ee180440a3e45ecaac11d970316803ce6c) | [55](https://git.erikinkinen.fi/erix/lib-time/actions/runs/55)/[56](https://git.erikinkinen.fi/erix/lib-time/actions/runs/56) | | [lib-driver issue](https://git.erikinkinen.fi/erix/lib-driver/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-driver/pulls/2) | [d509b04b346b](https://git.erikinkinen.fi/erix/lib-driver/commit/d509b04b346bc6f9a45e91a87bc663ed00a93ee6) | [31](https://git.erikinkinen.fi/erix/lib-driver/actions/runs/31)/[32](https://git.erikinkinen.fi/erix/lib-driver/actions/runs/32) | | [lib-input issue](https://git.erikinkinen.fi/erix/lib-input/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-input/pulls/2) | [d0997ac4a4ad](https://git.erikinkinen.fi/erix/lib-input/commit/d0997ac4a4ad1d952d07caa820b1110914d6d5df) | [30](https://git.erikinkinen.fi/erix/lib-input/actions/runs/30)/[31](https://git.erikinkinen.fi/erix/lib-input/actions/runs/31) | | [lib-posixabi issue](https://git.erikinkinen.fi/erix/lib-posixabi/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-posixabi/pulls/2) | [d5616f1fccc4](https://git.erikinkinen.fi/erix/lib-posixabi/commit/d5616f1fccc4a705de316a53c3d4d580374cb02d) | [15](https://git.erikinkinen.fi/erix/lib-posixabi/actions/runs/15)/[16](https://git.erikinkinen.fi/erix/lib-posixabi/actions/runs/16) | | [lib-stdio issue](https://git.erikinkinen.fi/erix/lib-stdio/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-stdio/pulls/2) | [78f31a4cecc7](https://git.erikinkinen.fi/erix/lib-stdio/commit/78f31a4cecc72547e41ff1f81451962dca71c553) | [19](https://git.erikinkinen.fi/erix/lib-stdio/actions/runs/19)/[20](https://git.erikinkinen.fi/erix/lib-stdio/actions/runs/20) | | [lib-tty issue](https://git.erikinkinen.fi/erix/lib-tty/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-tty/pulls/2) | [a42c108c2030](https://git.erikinkinen.fi/erix/lib-tty/commit/a42c108c203047075484bc22c1c83c9a8021c652) | [16](https://git.erikinkinen.fi/erix/lib-tty/actions/runs/16)/[17](https://git.erikinkinen.fi/erix/lib-tty/actions/runs/17) | | [lib-vfs issue](https://git.erikinkinen.fi/erix/lib-vfs/issues/1) / [PR](https://git.erikinkinen.fi/erix/lib-vfs/pulls/2) | [8d4c6299e0d3](https://git.erikinkinen.fi/erix/lib-vfs/commit/8d4c6299e0d35d745bc03dc51a75f82a570e3c7b) | [37](https://git.erikinkinen.fi/erix/lib-vfs/actions/runs/37)/[38](https://git.erikinkinen.fi/erix/lib-vfs/actions/runs/38) | Coherent terminal service adoption — 21 September 2026: All 35 application/service dependency checkpoints are signed and pushed. Thirty-four pass every maintained local strict configuration, normally four and additionally eight for Deviced and twenty for Logd; Exsh retains explicit incomplete gates below. E2fsd passes four 264-test selections with original explicit fixture tools; RTC passes each actual ELF stack-layout gate. Thirty-three services now have both original CI runs accepted: 66 runs, 2,879,508 complete hashed log bytes, zero warnings. Owning issues and WIP PRs are synchronized. Logd's original 239 passes; 240 has failed and both terminal log requests return HTTP 500. Cause and warning classification remain unresolved; no unchanged run was restarted. Both full catalogs pass original manifest/catalog equality against clean, signature-verified checkouts, selecting the original terminal observation, exact acknowledgement and final CPU graph. Signed Integration [dff878dd3545](https://git.erikinkinen.fi/erix/integration/commit/dff878dd3545c4751b3c05d37b2bdd5e21cce548) in [WIP PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12) publishes both coherent catalogs. All 169 helper commands pass with retained original source/socket setup refusals and the quiet-fixture timeout. The previously maintained traced disk invocation passes in 258.975743 seconds under unchanged 600/120 bounds; a fresh owned short path passes all 14 socket controls without relaxing the platform limit. The orchestration Rust inputs retain four strict 320/321-test configurations. Actual shell times, two-CPU Extop and out-of-session denial VMs pass under unchanged 120-second guest limits, with warning-free builds, empty QEMU stderr and all marker controls. Extop CPU percentages remain unavailable; numeric utilization and complete mediator lifetime are unproven. The ordinary startup image builds, but preflight rejects it before boot: [bug 69](https://git.erikinkinen.fi/erix/integration/issues/69) tracks the transition-feature and Kernel metadata gaps. Source admission, capture bounds and thresholds remain enforced. Original 1703/1704 is monitored separately. A local helper initially refused a stale native memory-support checkout; its original failure is retained and the already verified original checkout is now explicitly selected, without weakening source checks. - [VFS audit](https://git.erikinkinen.fi/erix/vfsd/issues/1) / [WIP PR 3](https://git.erikinkinen.fi/erix/vfsd/pulls/3): signed [378181a5840f](https://git.erikinkinen.fi/erix/vfsd/commit/378181a5840fab0433e350cf6519e729f9283fdc) removes ambient disassembler selection and inherited child environment. All 21 controls and both actual 167,632-byte runtime/smoke frame checks pass under the unchanged ceiling. Original 90/91 passes from 158,176 complete log bytes with zero warnings. The whole-program proof remains separate. - [Exsh audit](https://git.erikinkinen.fi/erix/exsh/issues/2) / [WIP PR 3](https://git.erikinkinen.fi/erix/exsh/pulls/3): signed `0d5d5ad9aff082ca75ec79dbc9c29d73f799d8ed` passes two 976-test development selections, four strict native/Clippy/private-rustdoc selections and 355 controls. Both release unit compilations stop at the unchanged silence deadline (126.117857/120.024146 seconds, clean owned cleanup) in [compiler regression 9](https://git.erikinkinen.fi/erix/exsh/issues/9). Actual runtime/all-feature frame reports remain incomplete with 97/63 unresolved routes in each deployment profile; [frame regression 4](https://git.erikinkinen.fi/erix/exsh/issues/4) remains open. Original 275/276 fails the required full-frame gate after 976 unit tests and 355 controls pass; four complete logs total 319,902 bytes with zero warnings. CI artifacts have 101/68 unresolved observations, separately from local 97/63. The corrected tool intake reaches actual analysis; [tool-selection issue 5](https://git.erikinkinen.fi/erix/exsh/issues/5) is closed, while frame and release-compiler gates remain open. - [Docs](https://git.erikinkinen.fi/erix/docs/issues/1) / [WIP PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4): signed [f8a40d45fbbd](https://git.erikinkinen.fi/erix/docs/commit/f8a40d45fbbd631660f3adca9152fbb398a4ee6d) passes 45 tests, all 2,431 manual pages and 449,997 rendered word bounds, plus visual review with zero final warnings. Original 999/1000 passes from 774,750 complete hashed log bytes; all 45 tests and 2,431 manual pages pass with zero final warnings. Early reference-convergence warnings remain retained. - [Procd consumer regression 5](https://git.erikinkinen.fi/erix/procd/issues/5) / [WIP PR 2](https://git.erikinkinen.fi/erix/procd/pulls/2): selector documentation at `68748bc65ea3fb798e810d624845dcb298ae1346` passes original 300/301 with unchanged validated runtime bytes. Ordinary metrics consumer loss/restart and final reply disposition remain open. Failed metrics transport stops Procd; continued row reuse after that failure is not established. The repeated static audit covers 3,164 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 173 direct missing-docs gates and all 92 conventional crate roots. These declarations and size checks do not establish semantic authority closure for every repository. Original Integration 1697/1698 retains 488/489 and 487/489 VM passes, passing Rust/Markdown and 28,115,674 complete log bytes without warnings. Both retain ext4 quota's original timeout in [issue 18](https://git.erikinkinen.fi/erix/integration/issues/18); 1698 additionally retains ext3 links in [issue 20](https://git.erikinkinen.fi/erix/integration/issues/20). Original 1699/1700 remains running and 1701/1702 waiting in the latest bounded observation. The newer acknowledged accounting graph still needs its own full service VM evidence. Acceptance stays **3.48% weighted; 15/460 items**. Actual service CPU/profiler VMs, ordinary and mediator lifetime, complete authority/source/effect/frame and Pagerd gates, native external Rust/LLVM/runtime rebuilding, and both complete EriX guest build generations remain mandatory and unproven. Actual service CPU scenarios and startup admission — 21 September 2026: The published original Integration catalog `dff878dd3545c4751b3c05d37b2bdd5e21cce548` passes the maintained shell times, two-CPU Extop and out-of-session denial VM scenarios under their unchanged 120-second guest limits. Each retains 106 hashed evidence files, warning-free image builds, empty QEMU stderr and every required, forbidden, ordered and unique marker check. Build-plus-scenario wall times are 119.876978, 34.802620 and 36.173027 seconds respectively; these are not guest-only or startup measurements. Times reports nonzero self and waited-child CPU. Extop observes both CPUs, memory and increasing job CPU nanoseconds with `CTRL no`; both per-CPU percentages remain `--.--%` in the two samples, so numeric utilization is unproven. The denial scenario confirms the existing out-of-session boundary. Complete mediator/lifecycle acceptance in [Procd 5](https://git.erikinkinen.fi/erix/procd/issues/5) remains open. A separate ordinary development package also builds without warnings, but its required startup-contract preflight exits 1 before any VM or observer starts. [Integration 69](https://git.erikinkinen.fi/erix/integration/issues/69) records the missing full-runtime-transition contract selections and Kernel effective-feature/original-source evidence. Preserve the refused package and all admission controls; the 120/15/10 capture limits and performance thresholds are unchanged. No startup-profile acceptance is awarded. Complete source/effect/frame and Pagerd proof, native external Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain required by [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65). Original full-regression observation — 21 September 2026: Original Integration [1699](https://git.erikinkinen.fi/erix/integration/actions/runs/1699)/[1700](https://git.erikinkinen.fi/erix/integration/actions/runs/1700), source `fcd7b4a9608f629a12de78c53da5c3615d906b46`, each finish at 487/489 VM passes. All six complete logs retain 28,483,276 bytes with zero warning candidates; Rust and Markdown jobs pass. The original worker boundaries identify quota's 120-second timeout in 1699 and 45-second serial stall in 1700, ext4 links' 120-second timeout in 1700, and FAT32 directory metadata's 120-second timeout in 1699. The latter has a distinct [canonical bug report](https://git.erikinkinen.fi/erix/integration/issues/70). Existing [quota 18](https://git.erikinkinen.fi/erix/integration/issues/18) and [links 20](https://git.erikinkinen.fi/erix/integration/issues/20) remain open. No shared root cause is inferred, and no unchanged rerun, cancellation or threshold relaxation is requested. Signed startup source/feature correction — 21 September 2026: Integration [fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) requires the complete runtime transition in both Rootd and its orchestration policy. The direct Kernel builder records the actual local compiler feature closure, compares original source before and after linking, and includes source identity in its cache key. Contract v2 requires the Kernel revision/tree and actual artifact/metadata binding; old receipts, synthetic wrappers and modified source cannot acquire this declaration. This remains local observed provenance, not publisher authentication or complete compiler closure. All 171 maintained helper commands have successful, warning-free final evidence. Eight new Kernel controls cover original trees, actual cfg closure, changed inputs, hidden/redirected source, custom builds, synthetic wrappers and cache identity. Sixteen fixture readers/writers now close files explicitly; [bug 71](https://git.erikinkinen.fi/erix/integration/issues/71) retains the original 36 resource warnings from 15 exit-zero commands. The previously unlisted filesystem-mirror fixture now participates in CI. Earlier Markdown failures also remain retained. Formatting, source policy and final Markdown pass; identical Rust inputs retain four strict orchestration matrices. The technical manual update [76672dff8ff83](https://git.erikinkinen.fi/erix/docs/commit/76672dff8ff83b04914abe3c8f4b08b13835144f) passes 45 tests, 2,431 pages, 450,096 word bounds and both changed-page visual reviews. Original Docs [1001](https://git.erikinkinen.fi/erix/docs/actions/runs/1001)/[1002](https://git.erikinkinen.fi/erix/docs/actions/runs/1002) passes from four complete logs totaling 774,770 bytes. Each manual log retains its earlier reference-convergence warnings; final LaTeX passes have no warnings or layout overflow. A fresh ordinary package from the signed Integration runner is under construction. Actual corrected image admission and startup capture remain pending under [bug 69](https://git.erikinkinen.fi/erix/integration/issues/69); no threshold or 120/15/10 capture limit changes. Original Integration [1705](https://git.erikinkinen.fi/erix/integration/actions/runs/1705)/[1706](https://git.erikinkinen.fi/erix/integration/actions/runs/1706) is monitored separately. Native external Rust/LLVM/runtime rebuilding and both complete EriX guest build generations remain mandatory. Actual original-source startup capture — 21 September 2026: Signed Integration [fd8a5cf0dbcf](https://git.erikinkinen.fi/erix/integration/commit/fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa) builds the ordinary image without warnings and its actual Kernel-bound contract passes preflight. The VM and complete observer finish with all required stages, zero dropped records, empty QEMU stderr, successful cleanup and unchanged source image. Admission bug 69 is resolved independently of performance. The strict timing gate fails: root-to-final readiness 5.974133160 seconds (limit 5), largest service interval 3.098663889 (limit 1), final readiness to caret 1.262470092 (limit 1), and four native commands 4.769234506 (limit 2). The maintained offline profiler identifies RTC-provider to TTYD as the largest service interval, followed by roughly one-second Powerboxd and Launchd intervals. These are host observation windows, not loader-only causal measurements. [The new canonical timing bug](https://git.erikinkinen.fi/erix/integration/issues/72) retains the exact image, timing and command identities and every original limit. Host/toolchain description fields remain explicitly incomplete; no provenance or speedup is invented. The sixteen helper stream-custody corrections also pass all changed controls; all 171 selected helper commands have successful warning-free final evidence. Bug 71 is resolved with its original 36 warnings retained. Full CI for 1705/1706 remains separately monitored. No startup-performance or full native toolchain/EriX guest-build acceptance is awarded. Current observation checkpoint — 21 September 2026: signed [9c62af2d2484](https://git.erikinkinen.fi/erix/integration/commit/9c62af2d2484b1ab0cadba768adc025dfd017485) records the actual startup outcome in the roadmap; executable and library inputs remain identical to the measured `fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa` implementation. Markdown, template structure and source policy pass. Original Integration 1701/1702 remains running; 1703–1708 remains queued. Logd 239 passes; 240 has failed, with both terminal log endpoints still returning HTTP 500. Its cause and warning classification remain unresolved. Original runs are preserved without restart or cancellation. All 3,165 authored code files remain below 1,000 lines; the static pin and missing-docs declaration checks remain intact. Full authority/source/effect/frame, startup performance and native external-toolchain/EriX guest-build acceptance remain open. Coherent scalar-consumer validation — 21 September 2026: signed [Integration 07c883525ee5](https://git.erikinkinen.fi/erix/integration/commit/07c883525ee5e23378008232760d045f74f60d32) selects [Procd 59ee30a88534](https://git.erikinkinen.fi/erix/procd/commit/59ee30a885346db4db8c8791a23c15694f2a90a8) in both complete catalogs. All 171 maintained helper commands pass without warnings; unchanged orchestration inputs retain four strict matrices. Five actual service VMs pass: shell CPU accounting, exec successor replacement, two-CPU read-only inspection, out-of-session denial and guarded realm preparation. Each preserves 106 hashed evidence files, clean QEMU stderr, warning-free image builds and all original markers under the unchanged 120-second guest limit. The build-plus-scenario times are 119.746880, 38.325332, 35.346729, 35.773237 and 55.339698 seconds respectively; these are not guest performance measurements. Inspection reports increasing job CPU counters with control disabled; numeric CPU utilization remains unproven. Procd's four strict 308/314-test configurations and original CI 302/303 pass. The [manual update](https://git.erikinkinen.fi/erix/docs/commit/2d05169e6974a495eab80b62edf0f23d1ad667da) passes 45 tests, all 2,431 pages, 450,185 word bounds and changed-page visual review. Original Docs CI 1003/1004 passes from four complete logs (774,710 bytes); retained reference-convergence warnings resolve to zero on final passes. All 3,166 authored code files remain below 1,000 lines. Original Integration 1701/1702 remains running; 1703–1710 remains queued. Logd 240 remains failed with terminal logs unavailable through HTTP 500; no cause is inferred. No original job was restarted or cancelled. Remaining lifecycle control/event ownership, complete native fault/cleanup acceptance and the measured startup timing failures remain open. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and using it in the required full EriX guest-build generations remain mandatory and unproven. Executed-code profiling checkpoint — 22 September 2026: signed [Integration 4fa27f942bc2](https://git.erikinkinen.fi/erix/integration/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0), tracked in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), adds bounded host TCG execution counters, explicit fresh-output ownership and exact packaged-ELF code candidates without adding guest authority. All 172 maintained helper commands pass without warnings. The profiler passes five Rust tests in both profiles, strict Clippy, private rustdoc, eleven Python controls and five actual selected-emulator controls. Unchanged orchestration inputs retain their preceding four strict matrices. The [operator guide](https://git.erikinkinen.fi/erix/integration/src/commit/4fa27f942bc2c6511eedceb5b20b8212f2bc94b0/docs/tcg-profiling.md) distinguishes complete counters from VM acceptance. One original-image diagnostic retains 92,896 translated blocks, 1,994,216 code bytes and zero missed execution counts. Its top 100 code groups cover 85.65% of the translated instruction upper bound; 33.30% has Kernel mapping-batch candidates and 7.70% has VSpace permission-switch candidates among the selected ELF inputs. Unknown and ambiguous work remains visible. These are code matches, not process ownership or elapsed-time attribution. Both the instrumented attempt and its same-emulator uninstrumented control fail waiting for the final native-command marker under unchanged 120/15/10 collection bounds. Neither proves startup acceptance, whole-transcript instrumentation overhead or a speedup. [Profiler acceptance](https://git.erikinkinen.fi/erix/integration/issues/3) and [startup performance](https://git.erikinkinen.fi/erix/integration/issues/72) remain open. The next optimization must preserve complete validation, live backing checks, page permissions, invalidation ordering and cleanup on errors. The signed [manual update](https://git.erikinkinen.fi/erix/docs/commit/1ade28490f4577bbf618f4cec49debf1f747aa6d), tracked in [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), passes 45 tests, all 2,431 pages, 450,367 word bounds and both changed-page visual reviews with zero final warnings or overflow. Original Docs CI 1005/1006 passes from four complete logs (774,674 bytes); initial reference-convergence warnings resolve on the final passes. Integration 1711/1712 is queued, while original 1701/1702 still runs. Existing queued jobs remain untouched. All 3,174 authored code files remain below 1,000 lines. No whole acceptance leaf closes: 15/460, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain inside EriX and completing the required full guest-build generations remain mandatory and unproven. Owned address-space preparation — 22 September 2026: [Kernel issue 22](https://git.erikinkinen.fi/erix/kernel/issues/22) records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed [Kernel 5e818e8b6d1d](https://git.erikinkinen.fi/erix/kernel/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), adds the [design contract](https://git.erikinkinen.fi/erix/kernel/src/commit/5e818e8b6d1d6da7698cfff34820d0aa9de8c05a/docs/owned-address-spaces.md) and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization. Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in [Integration 3](https://git.erikinkinen.fi/erix/integration/issues/3) and [Integration 72](https://git.erikinkinen.fi/erix/integration/issues/72). The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven. Native table-custody checkpoint — 22 September 2026: signed [Kernel 2e744897de7c](https://git.erikinkinen.fi/erix/kernel/commit/2e744897de7c330d3d095a65daed761a4e4a9406), in [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3), gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings. Signed [Integration fe63adde8ff9](https://git.erikinkinen.fi/erix/integration/commit/fe63adde8ff9529faf1261dbd5da3d7f39c0f2a6), in [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12), selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots. The [Kernel evidence update](https://git.erikinkinen.fi/erix/kernel/commit/f50535bfcd9aa57271762bb0b4da7d759d08906e) and [Integration evidence update](https://git.erikinkinen.fi/erix/integration/commit/1621164b93a7705eae381ff95aeec59b4e9527c3) change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; [18](https://git.erikinkinen.fi/erix/integration/issues/18), [20](https://git.erikinkinen.fi/erix/integration/issues/20) and [70](https://git.erikinkinen.fi/erix/integration/issues/70) have exact follow-up observations. No workflow was rerun or cancelled. All 3,176 authored code files remain below 1,000 lines. The next work in [Kernel 22](https://git.erikinkinen.fi/erix/kernel/issues/22) must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The [phase checklist](https://git.erikinkinen.fi/erix/integration/issues/65) stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Ordinary mapping-domain checkpoint — 22 September 2026: [resolved admission report](https://git.erikinkinen.fi/erix/kernel/issues/23) records the original host failure and bounded fix. The [fixture regression](https://git.erikinkinen.fi/erix/kernel/issues/24) retains all three distinct failed attempts and the verified layout correction. [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/ef3fd9293eaf691269fdb9e6b72eb15dac1f3f06) now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify. [Integration](https://git.erikinkinen.fi/erix/integration/commit/cd560584d034720ac179d5abc6f2a9d965943c63) pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. [Docs](https://git.erikinkinen.fi/erix/docs/commit/043df99baaa9d4539da627fbfe4a234e41e74135) documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation. Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Verified documentation and CI follow-up — 22 September 2026: [Kernel documentation](https://git.erikinkinen.fi/erix/kernel/commit/d0d9e25b71664126c29727265f285df2f5ae7fea) and [Integration documentation](https://git.erikinkinen.fi/erix/integration/commit/c41bb92cd0ff5444c1680bee476a70072529fdb0) record the accepted native mapping, three-grant cleanup and ordinary exec-successor evidence. Every executable file is identical to the tested implementation; Markdown and diff checks pass. All three failed fixture attempts remain in [report 24](https://git.erikinkinen.fi/erix/kernel/issues/24), separately from the fixed [admission defect](https://git.erikinkinen.fi/erix/kernel/issues/23). The complete manual passes 45 tests and 2,431 pages with no final warnings. The final static inventory covers 3,180 authored code files below 1,000 lines, 259 exact Git pins and the existing direct missing_docs declarations; it does not establish full semantic authority closure. Original full Integration [1703](https://git.erikinkinen.fi/erix/integration/actions/runs/1703)/[1704](https://git.erikinkinen.fi/erix/integration/actions/runs/1704), source dff878dd3545c4751b3c05d37b2bdd5e21cce548, pass from six complete logs totalling 26,964,178 bytes and zero warnings. Their ext4 quota/links and FAT32 directory scenarios explicitly pass. Earlier timing failures remain retained and their causes are unestablished. Kernel [634](https://git.erikinkinen.fi/erix/kernel/actions/runs/634)/[635](https://git.erikinkinen.fi/erix/kernel/actions/runs/635) report cancelled, with runner context-cancellation messages and four complete logs. No cancellation request was issued during this work; the workflow declares no cancellation policy, and the initiating cause remains unestablished. These runs receive no CI acceptance credit. Current Kernel [636](https://git.erikinkinen.fi/erix/kernel/actions/runs/636)/[637](https://git.erikinkinen.fi/erix/kernel/actions/runs/637) and Docs [1007](https://git.erikinkinen.fi/erix/docs/actions/runs/1007)/[1008](https://git.erikinkinen.fi/erix/docs/actions/runs/1008) pass. Each pair has four complete logs: Kernel totals 773,796 bytes with zero warnings, and Docs totals 774,706 bytes with zero final warnings. Both manual builds retain their initial 35/1/0 LaTeX warning sequence through convergence. Integration 1717–1720 remains queued. The phase checklist remains at 15/460 accepted leaves, weighted 3.48%. Private hardware roots, complete authority cleanup, measured startup improvement, native external Rust/LLVM/runtime rebuilding and both complete EriX guest-build generations remain open. VSpace MAP authority checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/25) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/9fdf1a17acc9204719fee42d263dacfcd701d56c). Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/c62dbf9d7096d41b5d073bc497949e16f5f16e13) selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/a96c994750ed10205e7bac17be6922a53070e2d6) passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings. The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [638](https://git.erikinkinen.fi/erix/kernel/actions/runs/638)/[639](https://git.erikinkinen.fi/erix/kernel/actions/runs/639) and Docs [1009](https://git.erikinkinen.fi/erix/docs/actions/runs/1009)/[1010](https://git.erikinkinen.fi/erix/docs/actions/runs/1010) pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1721](https://git.erikinkinen.fi/erix/integration/actions/runs/1721)/[1722](https://git.erikinkinen.fi/erix/integration/actions/runs/1722) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven. Frame access checkpoint — 22 September 2026: [the resolved bug report](https://git.erikinkinen.fi/erix/kernel/issues/26) records three original failing host controls and the verified correction in [Kernel](https://git.erikinkinen.fi/erix/kernel/commit/6671466a84cdc4994384e1b8391d6a01fa66fb09). Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/b45edf143f599699f80e70a13827762d3e4da77e) selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/45dae3cee4116b9387c4f3d3d2687a87f0fa340b) passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings. Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel [640](https://git.erikinkinen.fi/erix/kernel/actions/runs/640)/[641](https://git.erikinkinen.fi/erix/kernel/actions/runs/641) and Docs [1011](https://git.erikinkinen.fi/erix/docs/actions/runs/1011)/[1012](https://git.erikinkinen.fi/erix/docs/actions/runs/1012) pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration [1723](https://git.erikinkinen.fi/erix/integration/actions/runs/1723)/[1724](https://git.erikinkinen.fi/erix/integration/actions/runs/1724) remains queued; it receives no CI acceptance credit. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Ordinary protection contract — 22 September 2026: [the runtime memory design](https://git.erikinkinen.fi/erix/kernel/issues/1) now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory. Older VM regression observation — 22 September 2026: [the ext4 deadline report](https://git.erikinkinen.fi/erix/integration/issues/73) preserves original Integration CI 1705/1706 at `fd8a5cf0dbcf9a9cd3ddb6038370295e6ec2c8fa`. The complete 489-scenario catalog reports 482/7 and 485/4 pass/fail outcomes; eleven actual 120-second QEMU timeouts cover eight distinct ext4 scenarios. Rust 320/321-test configurations and Markdown pass. All six complete original logs are retained without warning candidates. Root cause, isolated reproduction and correction remain open; no rerun or relaxed limit supplies acceptance. External toolchain rebuilding and both complete EriX guest-build generations remain required. Current-grant protection checkpoint — 22 September 2026: [the resolved device-backing report](https://git.erikinkinen.fi/erix/kernel/issues/27) distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/f5dd939c462de9d62f317ab7d29c21779cbe11c7) permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/8a9f865364656351fd8b12914e404a97b0be11c7) selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. [Manual validation](https://git.erikinkinen.fi/erix/docs/commit/155b2a0cd2771cb45fa881155baf2cd0f1d1db27) passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow. Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. [Older Integration CI 1705/1706](https://git.erikinkinen.fi/erix/integration/issues/73) has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel [642](https://git.erikinkinen.fi/erix/kernel/actions/runs/642)/[643](https://git.erikinkinen.fi/erix/kernel/actions/runs/643) and Docs [1013](https://git.erikinkinen.fi/erix/docs/actions/runs/1013)/[1014](https://git.erikinkinen.fi/erix/docs/actions/runs/1014) pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration [1725](https://git.erikinkinen.fi/erix/integration/actions/runs/1725)/[1726](https://git.erikinkinen.fi/erix/integration/actions/runs/1726) remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. VSpace ownership preparation — 22 September 2026: Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed. Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred. The [Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/fa9491c65d173fa618c4c0ad241a5c4fe93d28e2) and [Integration source selection](https://git.erikinkinen.fi/erix/integration/commit/c17d8f1f18f55c0d159a80772ab8e5bbad8d7f04) are published with [Kernel validation evidence](https://git.erikinkinen.fi/erix/kernel/commit/14e38ec244976759214a5421c659de9b6f27beaf) and [Integration validation evidence](https://git.erikinkinen.fi/erix/integration/commit/29d778de650ba665b1ad9f143c12ef22baf62cbc). Continue under [owned-root design 22](https://git.erikinkinen.fi/erix/kernel/issues/22), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Publication CI: Kernel [644](https://git.erikinkinen.fi/erix/kernel/actions/runs/644)/[645](https://git.erikinkinen.fi/erix/kernel/actions/runs/645) pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration [1727](https://git.erikinkinen.fi/erix/integration/actions/runs/1727)/[1728](https://git.erikinkinen.fi/erix/integration/actions/runs/1728) remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in [Integration report 73](https://git.erikinkinen.fi/erix/integration/issues/73). Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted). Native occupancy diagnostic regression — 22 September 2026: [the original failure](https://git.erikinkinen.fi/erix/kernel/issues/28) is retained with exact signed source and packaged-ELF identity. The fixture maps a Kernel heap VA that the correct ordinary-domain guard rejects on the native upper-half heap. Host allocator addresses did not expose the mismatch. The correction must preserve the guard, 64-page/alias/hole/byte/cleanup controls and both maintained VM deadlines. The report was subsequently resolved by the verified recovery below. No canonical acceptance leaf closes. Managed-frame diagnostic recovery — 22 September 2026: [Kernel report 28](https://git.erikinkinen.fi/erix/kernel/issues/28) is resolved by the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/bc49d6da2684dae6073a03c422e0ea2265d03f31) and [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/69a1303d848d629efebcc532fff73457c3ab834f). The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc. Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction. Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration [1707](https://git.erikinkinen.fi/erix/integration/actions/runs/1707)/[1708](https://git.erikinkinen.fi/erix/integration/actions/runs/1708) both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel [646](https://git.erikinkinen.fi/erix/kernel/actions/runs/646)/[647](https://git.erikinkinen.fi/erix/kernel/actions/runs/647) pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration [1729](https://git.erikinkinen.fi/erix/integration/actions/runs/1729)/[1730](https://git.erikinkinen.fi/erix/integration/actions/runs/1730) remains queued and has no completed acceptance; [earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Supervisor physical-access window — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/046951899b8064be1cc90667a73e5abd2faa51ec) shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22); independent roots and their switching/reclamation proof remain open. Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The [coordinated Integration catalog](https://git.erikinkinen.fi/erix/integration/commit/4fe89e021e08e45e3a9ecb1c939aba03f90e5fb1) passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation. Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/589449e4172b48e31a889c82addc83096a94e02d) documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings. Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel [648](https://git.erikinkinen.fi/erix/kernel/actions/runs/648)/[649](https://git.erikinkinen.fi/erix/kernel/actions/runs/649) and Docs [1015](https://git.erikinkinen.fi/erix/docs/actions/runs/1015)/[1016](https://git.erikinkinen.fi/erix/docs/actions/runs/1016) pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration [1731](https://git.erikinkinen.fi/erix/integration/actions/runs/1731)/[1732](https://git.erikinkinen.fi/erix/integration/actions/runs/1732) remains queued and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Owned supervisor baseline — 22 September 2026: the [signed Kernel implementation](https://git.erikinkinen.fi/erix/kernel/commit/0f5049592f7801b2a2d92b1290fdcc655952f72f) captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation. Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [coordinated catalog](https://git.erikinkinen.fi/erix/integration/commit/122a3d77f7f879c32eba45ccdf2eba2fd9f8d3db) passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved. Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The [technical manual](https://git.erikinkinen.fi/erix/docs/commit/18b8b7160fc2f058f059ea3c41adeca5846f9f69) specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Publication CI: original Kernel [push 650](https://git.erikinkinen.fi/erix/kernel/actions/runs/650) passes and [PR 651](https://git.erikinkinen.fi/erix/kernel/actions/runs/651) retains the host fixture failure. [Regression 29](https://git.erikinkinen.fi/erix/kernel/issues/29) is resolved by [signed Kernel `12184850cd73`](https://git.erikinkinen.fi/erix/kernel/commit/12184850cd73fff066abcb7f97039a0828b2a928): a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and [push CI 652](https://git.erikinkinen.fi/erix/kernel/actions/runs/652)/[PR CI 653](https://git.erikinkinen.fi/erix/kernel/actions/runs/653). Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs [1017](https://git.erikinkinen.fi/erix/docs/actions/runs/1017)/[1018](https://git.erikinkinen.fi/erix/docs/actions/runs/1018) pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration [1733](https://git.erikinkinen.fi/erix/integration/actions/runs/1733)/[1734](https://git.erikinkinen.fi/erix/integration/actions/runs/1734) remains queued at the latest retained observation and has no completed acceptance. [Earlier ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. The retained baseline is a construction prerequisite for [owned address spaces](https://git.erikinkinen.fi/erix/kernel/issues/22). Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven. Huge-leaf geometry correction — 22 September 2026: [the bug report](https://git.erikinkinen.fi/erix/kernel/issues/30) preserves four original host failures and one passing WriteBack control. The [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/4f9cfcaeb63e9080f6d6a3e9fd190e6cb288c6fc) separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed. Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/ccc32eed0b4029a1ef82279c665811692c859985) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/587a280f59e55598e3a26b788d589955ebb84212) passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow. Publication CI: Kernel [654](https://git.erikinkinen.fi/erix/kernel/actions/runs/654)/[655](https://git.erikinkinen.fi/erix/kernel/actions/runs/655) and Docs [1019](https://git.erikinkinen.fi/erix/docs/actions/runs/1019)/[1020](https://git.erikinkinen.fi/erix/docs/actions/runs/1020) pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1735](https://git.erikinkinen.fi/erix/integration/actions/runs/1735)/[1736](https://git.erikinkinen.fi/erix/integration/actions/runs/1736) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven. First-start register custody — 22 September 2026: [the stack-domain bug report](https://git.erikinkinen.fi/erix/kernel/issues/31) preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the [signed correction](https://git.erikinkinen.fi/erix/kernel/commit/5bad7a1285089a20ee6425e0335ed3a5e96f7e29). Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work. Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The [catalog](https://git.erikinkinen.fi/erix/integration/commit/483da1e42cbdc79b56dea6fb0806980a128787b8) passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The [manual](https://git.erikinkinen.fi/erix/docs/commit/57bdb2811e2a90d0121ff6de6ab58ff797806b78) passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow. Publication CI: Kernel [656](https://git.erikinkinen.fi/erix/kernel/actions/runs/656)/[657](https://git.erikinkinen.fi/erix/kernel/actions/runs/657) and Docs [1021](https://git.erikinkinen.fi/erix/docs/actions/runs/1021)/[1022](https://git.erikinkinen.fi/erix/docs/actions/runs/1022) pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration [1737](https://git.erikinkinen.fi/erix/integration/actions/runs/1737)/[1738](https://git.erikinkinen.fi/erix/integration/actions/runs/1738) remains queued and has no completed acceptance. Earlier [ext4 CI deadline failures](https://git.erikinkinen.fi/erix/integration/issues/73) remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.

erikinkinen added the

ci

phase-6

refactor

enhancement

security

performance

docs

labels 2026-09-19 11:36:51 +02:00

erikinkinen referenced this issue 2026-09-19 11:38:14 +02:00

[FEATURE] Freeze the complete source, build, ABI and self-hosting inventory #1

erikinkinen referenced this issue 2026-09-19 11:38:15 +02:00

WIP: Coordinate native authority, shell workspace and source transport #12

erikinkinen referenced this issue from erix/docs 2026-09-19 12:01:48 +02:00

[FEATURE] Enforce complete inline documentation and warning-free documentation builds #1

erikinkinen referenced this issue from erix/docs 2026-09-19 12:01:52 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue 2026-09-19 12:22:56 +02:00

[BUG] Native realm-admission diagnostic exits before its success marker #66

erikinkinen referenced this issue from erix/kernel 2026-09-19 15:18:03 +02:00

[BUG] Process start must propagate grant census errors #18

erikinkinen referenced this issue from erix/kernel 2026-09-19 15:39:29 +02:00

[FEATURE] Bind staged child cleanup to its native supervisor lifetime #19

erikinkinen referenced this issue 2026-09-19 18:46:38 +02:00

[BUG] Development COM1 editor probe fails after the complete VM catalog passes #67

erikinkinen referenced this issue from erix/kernel 2026-09-19 20:18:35 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue from erix/kernel 2026-09-19 20:18:36 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue from erix/deviced 2026-09-19 22:55:23 +02:00

[BUG] Parallel cleanup tests race on shared quarantine state #4

erikinkinen referenced this issue from erix/lib-ipc 2026-09-19 23:00:25 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-ipc #1

erikinkinen referenced this issue from erix/lib-ipc 2026-09-19 23:00:26 +02:00

WIP: Define native authority and staged construction contracts #2

erikinkinen referenced this issue from erix/lib-capabi 2026-09-19 23:00:26 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-capabi #1

erikinkinen referenced this issue from erix/lib-capabi 2026-09-19 23:00:26 +02:00

WIP: Align capability layouts and staged authority contracts #2

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-19 23:00:27 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-bootstrap #1

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-19 23:00:27 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-19 23:00:27 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-interrupt #1

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-19 23:00:28 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-service 2026-09-19 23:00:28 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-service #1

erikinkinen referenced this issue from erix/lib-service 2026-09-19 23:00:29 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-time 2026-09-19 23:00:29 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-time #1

erikinkinen referenced this issue from erix/lib-time 2026-09-19 23:00:29 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-block 2026-09-19 23:00:30 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-block #1

erikinkinen referenced this issue from erix/lib-block 2026-09-19 23:00:30 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-log 2026-09-19 23:00:30 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-log #1

erikinkinen referenced this issue from erix/lib-log 2026-09-19 23:00:31 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-driver 2026-09-19 23:00:31 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-driver #1

erikinkinen referenced this issue from erix/lib-driver 2026-09-19 23:00:31 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-vfs 2026-09-19 23:00:32 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-vfs #1

erikinkinen referenced this issue from erix/lib-vfs 2026-09-19 23:00:32 +02:00

WIP: Align staged mediator protocol dependencies #2

erikinkinen referenced this issue 2026-09-19 23:09:19 +02:00

[BUG] Shared source catalog diverges from consumer dependency pins #68

erikinkinen referenced this issue from erix/rootd 2026-09-19 23:23:00 +02:00

[BUG] Installer authority change leaves the bootstrap audit baseline stale #6

erikinkinen referenced this issue from erix/lib-input 2026-09-19 23:29:07 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-input #1

erikinkinen referenced this issue from erix/lib-input 2026-09-19 23:29:08 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-stdio 2026-09-19 23:29:08 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-stdio #1

erikinkinen referenced this issue from erix/lib-stdio 2026-09-19 23:29:08 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/lib-tty 2026-09-19 23:29:09 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-tty #1

erikinkinen referenced this issue from erix/lib-tty 2026-09-19 23:29:09 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/procd 2026-09-19 23:30:50 +02:00

[FEATURE] Audit authority, code quality and documentation in procd #1

erikinkinen referenced this issue from erix/procd 2026-09-19 23:30:50 +02:00

WIP: Guard mediator construction and Launchd admission #2

erikinkinen referenced this issue from erix/launchd 2026-09-19 23:30:51 +02:00

[FEATURE] Audit authority, code quality and documentation in launchd #1

erikinkinen referenced this issue from erix/launchd 2026-09-19 23:30:51 +02:00

WIP: Select exact executable preparation for realm mediators #2

erikinkinen referenced this issue from erix/rootd 2026-09-19 23:30:53 +02:00

[FEATURE] Audit authority, code quality and documentation in rootd #1

erikinkinen referenced this issue from erix/rootd 2026-09-19 23:30:54 +02:00

WIP: Validate artifact boundaries and signed runtime sources #2

erikinkinen referenced this issue from erix/loaderd 2026-09-19 23:30:54 +02:00

[FEATURE] Audit authority, code quality and documentation in loaderd #1

erikinkinen referenced this issue from erix/loaderd 2026-09-19 23:30:55 +02:00

WIP: Enforce native RELRO and stage exact realm mediators #2

erikinkinen referenced this issue from erix/deviced 2026-09-19 23:30:55 +02:00

[FEATURE] Audit authority, code quality and documentation in deviced #1

erikinkinen referenced this issue from erix/deviced 2026-09-19 23:30:56 +02:00

WIP: Remove duplicate RTC logging and correct readiness fixtures #3

erikinkinen referenced this issue from erix/blockd 2026-09-19 23:53:20 +02:00

[FEATURE] Audit authority, code quality and documentation in blockd #1

erikinkinen referenced this issue from erix/blockd 2026-09-19 23:53:21 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/coreutils 2026-09-19 23:53:21 +02:00

[FEATURE] Audit authority, code quality and documentation in coreutils #1

erikinkinen referenced this issue from erix/coreutils 2026-09-19 23:53:21 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/crashd 2026-09-19 23:53:22 +02:00

[FEATURE] Audit authority, code quality and documentation in crashd #1

erikinkinen referenced this issue from erix/crashd 2026-09-19 23:53:22 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-acpi 2026-09-19 23:53:23 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-acpi #1

erikinkinen referenced this issue from erix/drv-acpi 2026-09-19 23:53:23 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-i8042 2026-09-19 23:53:23 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-i8042 #1

erikinkinen referenced this issue from erix/drv-i8042 2026-09-19 23:53:24 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-ps2-keyboard 2026-09-19 23:53:24 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-ps2-keyboard #1

erikinkinen referenced this issue from erix/drv-ps2-keyboard 2026-09-19 23:53:25 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-ps2-mouse 2026-09-19 23:53:25 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-ps2-mouse #1

erikinkinen referenced this issue from erix/drv-ps2-mouse 2026-09-19 23:53:26 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-rtc-cmos 2026-09-19 23:53:26 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-rtc-cmos #1

erikinkinen referenced this issue from erix/drv-rtc-cmos 2026-09-19 23:53:27 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-serial 2026-09-19 23:53:27 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-serial #1

erikinkinen referenced this issue from erix/drv-serial 2026-09-19 23:53:27 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/drv-virtio-block 2026-09-19 23:53:28 +02:00

[FEATURE] Audit authority, code quality and documentation in drv-virtio-block #1

erikinkinen referenced this issue from erix/drv-virtio-block 2026-09-19 23:53:28 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/dynlinkd 2026-09-19 23:53:29 +02:00

[FEATURE] Load compatibility ELF, TLS, constructors and declared runtime modules safely #1

erikinkinen referenced this issue from erix/dynlinkd 2026-09-19 23:53:29 +02:00

WIP: Align signed runtime dependencies #3

erikinkinen referenced this issue from erix/extop 2026-09-19 23:53:29 +02:00

[FEATURE] Audit authority, code quality and documentation in extop #1

erikinkinen referenced this issue from erix/extop 2026-09-19 23:53:30 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/fatd 2026-09-19 23:53:31 +02:00

[FEATURE] Audit authority, code quality and documentation in fatd #1

erikinkinen referenced this issue from erix/fatd 2026-09-19 23:53:32 +02:00

WIP: Correct standalone service linking and reject linker warnings #3

erikinkinen referenced this issue from erix/fbcond 2026-09-19 23:53:33 +02:00

[FEATURE] Audit authority, code quality and documentation in fbcond #1

erikinkinen referenced this issue from erix/fbcond 2026-09-19 23:53:33 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/hotplugd 2026-09-19 23:53:34 +02:00

[FEATURE] Audit authority, code quality and documentation in hotplugd #1

erikinkinen referenced this issue from erix/hotplugd 2026-09-19 23:53:34 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/inputd 2026-09-19 23:53:35 +02:00

[FEATURE] Audit authority, code quality and documentation in inputd #1

erikinkinen referenced this issue from erix/inputd 2026-09-19 23:53:36 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/irqd 2026-09-19 23:53:36 +02:00

[FEATURE] Audit authority, code quality and documentation in irqd #1

erikinkinen referenced this issue from erix/irqd 2026-09-19 23:53:36 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/keyd 2026-09-19 23:53:37 +02:00

[FEATURE] Audit authority, code quality and documentation in keyd #1

erikinkinen referenced this issue from erix/keyd 2026-09-19 23:53:37 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/logd 2026-09-19 23:53:38 +02:00

[FEATURE] Audit authority, code quality and documentation in logd #1

erikinkinen referenced this issue from erix/logd 2026-09-19 23:53:38 +02:00

WIP: Validate production logging configurations #4

erikinkinen referenced this issue from erix/memd 2026-09-19 23:53:38 +02:00

[FEATURE] Audit authority, code quality and documentation in memd #1

erikinkinen referenced this issue from erix/memd 2026-09-19 23:53:39 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/named 2026-09-19 23:53:40 +02:00

[FEATURE] Audit authority, code quality and documentation in named #1

erikinkinen referenced this issue from erix/named 2026-09-19 23:53:40 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/pagerd 2026-09-19 23:53:41 +02:00

[FEATURE] Audit authority, code quality and documentation in pagerd #1

erikinkinen referenced this issue from erix/pagerd 2026-09-19 23:53:41 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/powerboxd 2026-09-19 23:53:41 +02:00

[FEATURE] Audit authority, code quality and documentation in powerboxd #1

erikinkinen referenced this issue from erix/powerboxd 2026-09-19 23:53:42 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/e2fsd 2026-09-19 23:55:59 +02:00

[FEATURE] Audit authority, code quality and documentation in e2fsd #1

erikinkinen referenced this issue from erix/e2fsd 2026-09-19 23:55:59 +02:00

WIP: Validate filesystem media and explicit build inputs #3

erikinkinen referenced this issue from erix/probed 2026-09-19 23:55:59 +02:00

[FEATURE] Audit authority, code quality and documentation in probed #1

erikinkinen referenced this issue from erix/probed 2026-09-19 23:56:00 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/ramfsd 2026-09-19 23:56:00 +02:00

[FEATURE] Audit authority, code quality and documentation in ramfsd #1

erikinkinen referenced this issue from erix/ramfsd 2026-09-19 23:56:00 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/seriald 2026-09-19 23:56:01 +02:00

[FEATURE] Audit authority, code quality and documentation in seriald #1

erikinkinen referenced this issue from erix/seriald 2026-09-19 23:56:01 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/timed 2026-09-19 23:56:01 +02:00

[FEATURE] Audit authority, code quality and documentation in timed #1

erikinkinen referenced this issue from erix/timed 2026-09-19 23:56:01 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/ttyd 2026-09-19 23:56:02 +02:00

[FEATURE] Complete independent consoles, vttys, TUI, keyboard layouts, mouse and boot logo #1

erikinkinen referenced this issue from erix/ttyd 2026-09-19 23:56:02 +02:00

WIP: Align signed runtime dependencies #3

erikinkinen referenced this issue from erix/vfsd 2026-09-19 23:56:03 +02:00

[FEATURE] Audit authority, code quality and documentation in vfsd #1

erikinkinen referenced this issue from erix/vfsd 2026-09-19 23:56:03 +02:00

WIP: Harden VFS frame validation and service integration #3

erikinkinen referenced this issue from erix/vspaced 2026-09-19 23:56:03 +02:00

[FEATURE] Audit authority, code quality and documentation in vspaced #1

erikinkinen referenced this issue from erix/vspaced 2026-09-19 23:56:03 +02:00

WIP: Align signed runtime dependencies #2

erikinkinen referenced this issue from erix/procd 2026-09-21 16:49:39 +02:00

[BUG] Attenuated installer handoff changes the managed return slot #4

erikinkinen referenced this issue from erix/kernel 2026-09-21 17:23:03 +02:00

[FEATURE] Retain final process accounting until acknowledged observation #20

erikinkinen referenced this issue from erix/kernel 2026-09-21 18:09:25 +02:00

[BUG] Native diagnostic page census omits terminal accounting backing #21

erikinkinen referenced this issue from erix/procd 2026-09-21 18:48:55 +02:00

[BUG] Terminal retirement loses notification or mediator CPU evidence #5

erikinkinen referenced this issue from erix/rootd 2026-09-21 19:00:24 +02:00

[BUG] Bootstrap authority audit omits terminal acknowledgement call #7

erikinkinen referenced this issue from erix/lib-posixabi 2026-09-21 19:05:26 +02:00

[FEATURE] Define and validate the pure POSIX compatibility ABI #1

erikinkinen referenced this issue from erix/lib-posixabi 2026-09-21 19:05:27 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-posixabi #2

erikinkinen referenced this issue from erix/exsh 2026-09-21 19:53:35 +02:00

[BUG] Release shell unit-test compilation exceeds the bounded silence deadline #9

erikinkinen referenced this issue from erix/exsh 2026-09-21 20:28:17 +02:00

[FEATURE] Complete native shell/build utilities and provide help and offline manual pages #1

erikinkinen referenced this issue from erix/exsh 2026-09-21 20:28:23 +02:00

[FEATURE] Audit authority, code quality and documentation in exsh #2

erikinkinen referenced this issue from erix/exsh 2026-09-21 20:28:25 +02:00

WIP: Bind shell workspace and cleanup frame evidence #3

erikinkinen referenced this issue from erix/exsh 2026-09-21 20:28:27 +02:00

[BUG] Exsh stack proof assumes incidental optimized symbol names #4

erikinkinen referenced this issue 2026-09-21 20:54:15 +02:00

[FEATURE] Audit authority, code quality and documentation in integration #11

erikinkinen referenced this issue 2026-09-21 21:05:02 +02:00

[BUG] Ordinary development package cannot supply its startup profiling contract #69

erikinkinen referenced this issue 2026-09-21 21:12:57 +02:00

[FEATURE] Maintain bounded profiling and eliminate evidenced startup and build bottlenecks #3

erikinkinen referenced this issue 2026-09-21 21:23:52 +02:00

[BUG] Existing FAT32 directory metadata VM exceeds its original deadline #70

erikinkinen referenced this issue 2026-09-21 21:33:04 +02:00

[BUG] Integration fixture readers leave file handles open despite successful exits #71

erikinkinen referenced this issue 2026-09-21 21:44:03 +02:00

[BUG] Completed ordinary startup exceeds the maintained readiness and command limits #72

erikinkinen referenced this issue from erix/kernel 2026-09-21 23:45:23 +02:00

[FEATURE] Own hardware page-table roots for native address-space switching #22

erikinkinen referenced this issue from erix/kernel 2026-09-21 23:56:10 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue from erix/kernel 2026-09-22 01:33:21 +02:00

[BUG] Ordinary frame mapping admits destinations outside the user domain #23

erikinkinen referenced this issue from erix/kernel 2026-09-22 01:33:21 +02:00

[BUG] Native mapping fixture conflicts with the caller capability layout #24

erikinkinen referenced this issue from erix/kernel 2026-09-22 02:20:14 +02:00

[BUG] VSpace mapping changes ignore attenuated MAP rights #25

erikinkinen referenced this issue from erix/kernel 2026-09-22 03:19:35 +02:00

[BUG] Frame mappings add unrequested user read access #26

erikinkinen referenced this issue 2026-09-22 04:08:51 +02:00

[BUG] Existing ext4 VM scenarios exceed their original QEMU deadlines #73

erikinkinen referenced this issue from erix/kernel 2026-09-22 04:31:30 +02:00

[BUG] Reused device-frame slots authorize protection of unrelated backing #27

erikinkinen referenced this issue from erix/kernel 2026-09-22 05:31:18 +02:00

[BUG] Managed-frame occupancy diagnostic maps a Kernel heap address outside the ordinary domain #28

erikinkinen referenced this issue from erix/kernel 2026-09-22 07:39:20 +02:00

[BUG] Drop-local-cap window fixture inherits the previous private process #29

erikinkinen referenced this issue from erix/kernel 2026-09-22 08:32:10 +02:00

[BUG] Huge-leaf translation and splitting confuse PAT with physical address bits #30

erikinkinen referenced this issue from erix/kernel 2026-09-22 09:18:29 +02:00

[BUG] Initial stack materialization accepts addresses outside the ordinary user domain #31

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

ci-feature-posix-compat

nightly

ci-feature-native-cli

ci-feature-phase-4-audit

ci-feature-dynlink

ci-feature-program-loader

ci-feature-e2fs-fat

ci-feature-block-devices

ci-feature-vfs

ci-feature-centralized-process-authority

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/integration#65

No description provided.