[FEATURE] Own native IPC requests, results and completion custody #11

New issue

Open

opened 2026-09-14 13:56:58 +02:00 by erikinkinen · 0 comments

erikinkinen commented 2026-09-14 13:56:58 +02:00

Owner

Copy link

Problem and motivation

Realm bootstrap and compatibility operations need native ownership of requests, results and capability transfers while a peer is running or unavailable. Intake acceptance, application completion, result collection, alias revocation and provider cleanup are different events. The accepted local lifetime primitive in #7 accounts for a deposited SEND lineage; it does not supply this operation-completion contract.

Define the native substrate before implementing the capability-bearing Posixd provisioning and configuration handshakes. This proposal specifies desired behavior, not an implemented interface or a report of an existing vulnerability.

Proposed behavior and scope

Introduce an explicitly owned invocation protocol in Kernel and lib-ipc, then adopt it coherently in the realm producers and mediator. The proposed client lifecycle is begin, status/poll, collect, acknowledge and abandon; the serving process receives a distinct authenticated delivery identity and completes that exact invocation. These are semantic operations, not assigned opcode values or finalized wire layouts.

Ingress copies and validates request bytes and transfer intent while the caller's supplied storage is available. After successful admission, native ownership covers every retained byte and capability until an explicit transition disposes or transfers it. An invocation selector is bound to the actual caller TCB and nonwrapping stage/invocation generations; it is not a foreign-process selector or a new general capability.

Status reads descriptive state without installing capabilities. Collection supplies fresh writable storage and exact admitted destination slots, validates all remaining authority, and installs each carried grant at most once. Repeated byte collection cannot mint another alias. Acknowledgment releases retained metadata after collection. Abandonment relinquishes result interest and enters accounted draining; it is not proof of application cancellation or rollback.

Capability-bearing requests and replies are in scope. Source slots and receipts cannot substitute for owned live object bindings, rights, move-only custody and revocation lineage. Application objects, children and provider leases need their own producer disposition rules; the transport must report ownership transitions without claiming it can undo arbitrary application effects.

Authority, security and reliability

Admit work only through the caller's actual endpoint authority and bind delivery to the exact serving native process/generation and receiver context. A late completion must target its original delivery identity after receiver retirement or endpoint reuse; an endpoint number alone cannot select a later invocation.

Reserve request, result, receipt, capability-custody and rollback capacity before externally visible acceptance. Admission failures preserve original caller ownership. Rejected collection preserves native result custody and installs nothing. Transfer validation preserves exact move-only rules and attenuated rights; revocation must not recreate a removed alias. Kernel-owned escrow must expose no root CSpace, CNode handle, general object selector or fallback authority.

Caller and server exit, cancellation, partial delivery, failed result copy and uncertain cleanup retain a named native owner and first error. Ordinary success and reusable identities require their own completed transition. Existing application cancellation/lease protocols remain separate. Process and invocation identities must not wrap onto retained state. Security and reliability gates precede allocation or throughput optimization.

Acceptance criteria

• Document the complete client/server state machine, native object ownership, error precedence, transfer disposition and producer migration before assigning ABI numbers.
• Prove actual native request delivery and result collection with two distinct caller processes and a real serving process; inspect exact bytes, actual process generations and capability receipts.
• Prove caller storage can cease to be the request/result backing after successful ingress; later peer work uses native-owned storage and collection uses a freshly admitted buffer.
• Test wrong caller/server/generation, foreign selectors, premature or repeated collection/acknowledgment, replayed completion and endpoint reuse. No extra grant may appear.
• Test copy and move-only transfers, attenuation, revoked escrow, occupied/out-of-window destinations, allocation refusal before admission, failed collection and cleanup after both peers' terminal transitions.
• Distinguish transport draining from application cancellation and provider/child cleanup using real producer receipts. A payload-only model does not establish capability-bearing acceptance.
• Run formatting, strict Clippy, warning-denied host/target builds, unit/doc tests and new VM coverage with original pinned sources. Preserve existing VM and unit regression gates during migration.
• Profile admitted invocation allocation, copy volume and collection cost under declared budgets. Avoid repeated full capability scans and redundant payload copies when correctness permits; do not replace policy budgets with an incidental fixed table size.

Alternatives and tradeoffs

Retaining caller buffers until a peer finishes complicates independent scheduling and native lifetime ownership. A userspace-only result table cannot itself establish the kernel's transfer, delivery-identity and terminal guarantees. A request/result record containing only numeric former source slots cannot own a moved capability.

A private per-invocation CSpace and a dedicated native capability-location abstraction are implementation candidates. The former can reuse existing transfer machinery but consumes existing CSpace/slot identity resources and needs exact teardown; the latter changes object-binding and revocation accounting more broadly. Select only after source-grounded ownership and resource experiments. Neither is adopted by this issue. Preserve narrow completion authority without turning a delivery token into a new general receive or process-control route.

Allocator validation checkpoint — 14 September 2026: The allocator experiment removes live-table scanning and demonstrates allocation-failure identity preservation, but does not select escrow storage. A private empty CSpace does not pre-reserve every slot or typed binding. Existing transfer descriptor reservation is separate from payload/result and type-specific binding/rollback admission. The next design step must enumerate those contracts and define the full caller/server state machine before selecting a capability-location representation or ABI. No additional IPC experiment or vulnerability finding is claimed. Signed Kernel feature ae0f3ab918abec71e809c3b4a68e54ec1c475e0d carries original signed maintenance ancestor 41b57a7a67e6fee71f5708b55ab386b72366b8d8. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI 536 and 537 pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim.

Endpoint construction checkpoint — 14 September 2026: The focused owned-invocation design defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding. Signed Kernel f6489ff3f8fea88a26dad232cc45d0deb33fa30e carries original signed ordinary ancestor c7f8952c45a60ca451466d9731207c0a9a6a9a82. Its feature tree equals the validated fc3e1d5ea095fd17a9629a87d05ddad0863435ca tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 540/541 passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes.

Completed CI checkpoint — 15 September 2026: Signed Integration a869a81eb406a4f027a2b5db573b6330ca114d94 passes both 1607/1608; signed endpoint-construction checkpoint 989d44d604d07c4c9bcc23264912bdf2076b99eb passes both 1609/1610. Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation.

Native transfer preparation checkpoint — 15 September 2026: Signed Kernel e91f47198748d8ce52fc7361f389836a6bc2a206 carries original signed ordinary ancestor d2438c7e56c964a9c16720586cf718ec11e7cc0a. The feature tree is byte-identical to validated d58efd8df18d63e5b97228c066f6d7623202e6d4. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI 544/545 passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under Kernel issue 11. No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure.

Native invocation custody checkpoint — 15 September 2026: Signed Kernel 2e4deb7351184d3fe4517ce8d5d59eb9960f28ad carries the native invocation core from b1b632446ff5762761b5aee3fbdba320f5efff42 and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel issue 13 retains CI 546/547: both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI 548/549 and Docs 859/860 pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure.

Delivery-origin contract — 15 September 2026: each successful native request claim will return the submitting process ID and its exact staged generation from the invocation's retained kernel actor. These use the same identity domain as CREATE_STAGED_PROCESS and the existing pending-caller observation, and contain neither a CSpace identifier nor a selectable capability. The kernel derives both fields at submission; payload bytes, receiving-process identity and equal numeric source slots cannot replace them. This is an attestation of the submitted request's origin, not a promise of later process liveness or authorization for a subsequent operation. Services must correlate it with their exact retained process/realm ownership and revalidate after blocking effects. The delivery selector remains independently bound to the serving process and receiver registration. Distinct actual submitters sharing a carrier must yield distinct correct origin pairs even when their payloads impersonate one another. No syscall number or wire layout is assigned by this native-field change.

Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel 69c5e1fe5ffa72522ff6611d8b2c0471e865115e adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI 550/551 and Docs 861/862 pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in Kernel issue 13, preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits.

Native invocation workload profile contract — 15 September 2026: add a maintained host workload using actual kernel process, CSpace, endpoint and revocation objects plus public owned-invocation entry points. Measure queued-request progress, collected-result progress, repeated collection and full request cycles against explicitly selected retained populations. Separate setup, operation and cleanup durations; retain exact source/binary identity, parameters, actual completed-operation counts and independent caller-origin, FIFO, byte, capability, foreign-selector and final-disposal checks. Each sample uses one owned process and explicit inputs, deadlines and output budgets; no VM, network, signing credential or unrelated-process authority is required for measurement. Integration must retain complete process status and raw evidence, reject incomplete or mismatched samples, and report comparisons only for equivalent source/workload contexts. Build once per source into distinct targets and run uncontended before/after samples. Host measurements do not establish guest or self-host-build throughput. The current global registry and endpoint-binding scans are hypotheses until measured; any optimization must preserve exact identity, allocation-safe publication and accounted revocation/terminal cleanup. Ordinary functional tests gain no timing-ratio assertion.

Native invocation profiling baseline — 15 September 2026: Signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration f3e4359b34cb8f7db732fbf38823f722553c86d4 adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs 644273a0edd91e4c38dcd4418d6ae1119ff1f10b describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits.

Measured native invocation lookup refinement — 15 September 2026: Signed Kernel 8349d68636382cc7e25a3347f5f1df216554203a retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration 108501cf7ec20f05dd3d62ea401ea8adad6c6e9c selects this Kernel in its isolated native catalog, and signed Docs f10a1d375a326543ec0adda4569bc7cb4faca9b6 documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel 6cb703e1ed8b9de0d29a37189cd914cd501e732e and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits.

Owned invocation wire contract — 15 September 2026

This v1 contract connects the Kernel's native request/result custody to explicit
userspace peers. It is tracked in kernel #11 and lib-ipc #1.
Shared codecs alone do not establish native execution or realm acceptance.

Registers and ownership

All numbers and packet fields are unsigned. Packet integers are little endian
and require no alignment. RAX selects the syscall; arguments are RDI, RSI, RDX,
R10, R8 and R9 in that order. Unlisted arguments must be zero. Return RAX is an
ordinary IPC result code; RDX carries the operation-specific value below and
R8 is zero. A rejected operation returns zero RDX unless SUBMIT explicitly
reports a retained draining owner. Calls do not retain any userspace pointer.

Number	Operation	Arguments	Successful RDX
0x4C	REGISTER	local RECV slot	zero
0x4D	SUBMIT	local SEND slot, input pointer, input length	invocation ID
0x4E	CLAIM	local RECV slot, receive pointer, receive length	delivery ID
0x4F	COMPLETE	local RECV slot, delivery ID, input pointer, input length	zero
0x50	COLLECT	invocation ID, receive pointer, receive length	zero
0x51	PROGRESS	invocation ID	packed progress
0x52	RELEASE	invocation ID	packed transition
0x53	RELINQUISH	delivery ID	packed transition

IDs are nonzero opaque numbers, scoped to the actual current process, generation
and CSpace. They never choose a process or grant capability authority. REGISTER
requires an existing generic endpoint. SUBMIT requires SEND and additionally
GRANT for capability inputs. CLAIM and COMPLETE require the exact registered
receiver and actual RECV; capability completion additionally requires GRANT.
RELINQUISH acknowledges only an invalidated delivery owned by that serving
process; it does not require a surviving receiver capability. RELEASE abandons
future collection and starts native retirement, without undoing provider effects.

SUBMIT may return a nonzero failure code AND a nonzero invocation ID: ingress
could not be completed but native disposal remains accounted to that owner.
It cannot subsequently be delivered. The caller must retain that ID for progress
and release. A nonzero code with zero ID is an ordinary rejected submission.
CLAIM/COLLECT return RAX zero after a committed delivery even if subsequent
native disposal is draining; the receive header carries that distinction.
Their rejection leaves the receive packet and destination inventory unchanged.
COMPLETE accepts its result exactly once. Repeated COLLECT is descriptive: no
second capability transfer, and the destination list must be empty.

Packed transition uses bit 0 for draining and bits 32–63 for its nonzero native
code; all other bits are zero. Complete is exactly zero. Packed progress uses
bits 0, 1, 2 and 3 for request delivered, completion accepted, result collected
and draining; bit 4 says a first error is present, with that nonzero code in bits
32–63. All other bits are zero. Draining may have no first error when release
awaits server bookkeeping. Progress flags report history, not new authority.

Input packet

The fixed header is 40 bytes, followed by capability inputs and then payload.
The exact packet size is 40 + 8 * capability_count + payload_bytes.

Offset	Width	Meaning
0	4	ASCII OIV1
4	2	version, exactly 1
6	2	header size, exactly 40
8	8	payload byte count
16	8	capability count
24	8	maximum result bytes reserved by SUBMIT
32	8	maximum result capabilities reserved by SUBMIT

Each capability input is a four-byte current source slot and four-byte requested
rights. COMPLETE requires both result budgets to be zero. The kernel copies
input bytes and retains actual admitted native bindings before returning; caller
mutation or unmapping after return cannot change the accepted request/result.
Possession, type, attenuation, provenance and lifetime checks remain native.

Receive packet

The fixed header is 64 bytes, then four-byte destination slots, then twelve-byte
receipt capacity, then byte capacity. Its exact size is
64 + 4 * destination_count + 12 * receipt_capacity + byte_capacity.

Offset	Width	Meaning
0	4	ASCII OIR1
4	2	version, exactly 1
6	2	header size, exactly 64
8	8	byte capacity
16	8	destination count
24	8	receipt capacity
32	8	returned byte count, initially zero
40	8	returned receipt count, initially zero
48	4	attested caller process, initially zero
52	4	attested caller generation, initially zero
56	4	draining code, initially zero
60	4	transition flags, initially zero; only bit 0 is defined

Destination and receipt capacities are distinct to support repeat collection.
First delivery requires enough destinations and receipts for all actual inputs;
only the used destination prefix is validated or populated. Spare destinations
and unused receipt/payload capacity remain unchanged, acquire no authority and
are not returned as evidence. A receipt is destination slot, native capability
type and admitted rights, each four bytes. It describes a committed transfer,
not a transferable capability. CLAIM supplies the retained caller's process and
generation. COLLECT leaves those two fields zero. No caller-supplied identity is
accepted. Output counts must fit capacities; draining requires a nonzero code.

Validation and lifetime

Overflow, size mismatch, noncanonical headers, unsupported versions, nonzero
initial output fields and reserved register inputs reject before native custody
changes. There is no inherited 32 KiB CALL limit. Actual addressability, native
CSpace limits, caller budgets and fallible allocation still constrain admission.
The entire input span must be freshly readable; the entire receive span must be
freshly readable and writable in the current process's actual VSpace. Kernel,
noncanonical, stale, overflowed and partly inaccessible spans reject.

Mapping validation, packet admission, native effects and output publication share
one existing process-lifecycle exclusion interval. All allocation and fallible
output checks precede native delivery. Destination input is snapshotted before
outputs are written. No userspace pointer, borrowed descriptor, receiver-selected
CSpace or ambient allocator/provider authority enters retained custody. Hosted
raw-pointer dispatch is refused; safe codec/object tests and actual CPL3 tests
provide distinct evidence. Existing CALL/REPLY semantics remain unchanged.

Acceptance and rollout

Literal packet fixtures, arithmetic/malformed negatives, complete and draining
returns, spare destinations, repeated collection, exact-owner refusal, revoked
bindings, fresh mapping checks and real CPL3 request/capability round trips must
pass. Existing unit and VM regressions remain mandatory. Producers and consumers
select original signed commit pins after strict validation. Realm lifecycle and
complete in-guest builds remain separate gates. A peek/sizing syscall is avoided
by admitting capacity; numeric identities never bypass native ownership checks.

Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel 5f497adaefa526108a0439e0e071717dddb85334, shared IPC de968da19898bef532ddb3b5974bb9562f51dee5, capability ABI a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0 and Integration 9030b217c490db6ad3ec60a799cb025eccbfcdb1 implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d and 8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673 respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs 46da7a4cb4d38a2bea5b5491a68f51f33e4b4305 publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.

Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required.

Process-bound native acceptance — 15 September 2026: Signed Kernel 60da5858d7198185efd103f0e91e5ac2e0b63e67 implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd f1105706cc19ed024a6cca79a29abc57c90c6661 uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC c453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABI fe8d558253ad01301b99554e20d287c4ea35bb1d and five aligned helper commits preserve original Git/type identity. Integration 58c925c564b69bebce8df6f3e75a9312824e18c4 passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is 8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256 b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs b0fcf0f43af2af741d520a0b1373cc346e08863c updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.

Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.

Tracking and rollout

Related: #1, #2, lifetime design #7, Posixd design issue 1, Kernel PR 3 and Integration PR 12.

Sequence the ownership design, native mechanism, full request/reply capability tests, producer/consumer migration and real two-realm byte I/O. Keep ordinary source graphs coherent and never reinterpret existing reserved registers or startup fields. Remove superseded transport paths only after all owning consumers and regression gates migrate. The full build and second-generation build inside EriX remain separate phase acceptance gates.

## Problem and motivation Realm bootstrap and compatibility operations need native ownership of requests, results and capability transfers while a peer is running or unavailable. Intake acceptance, application completion, result collection, alias revocation and provider cleanup are different events. The accepted local lifetime primitive in #7 accounts for a deposited SEND lineage; it does not supply this operation-completion contract. Define the native substrate before implementing the capability-bearing Posixd provisioning and configuration handshakes. This proposal specifies desired behavior, not an implemented interface or a report of an existing vulnerability. ## Proposed behavior and scope Introduce an explicitly owned invocation protocol in Kernel and lib-ipc, then adopt it coherently in the realm producers and mediator. The proposed client lifecycle is begin, status/poll, collect, acknowledge and abandon; the serving process receives a distinct authenticated delivery identity and completes that exact invocation. These are semantic operations, not assigned opcode values or finalized wire layouts. Ingress copies and validates request bytes and transfer intent while the caller's supplied storage is available. After successful admission, native ownership covers every retained byte and capability until an explicit transition disposes or transfers it. An invocation selector is bound to the actual caller TCB and nonwrapping stage/invocation generations; it is not a foreign-process selector or a new general capability. Status reads descriptive state without installing capabilities. Collection supplies fresh writable storage and exact admitted destination slots, validates all remaining authority, and installs each carried grant at most once. Repeated byte collection cannot mint another alias. Acknowledgment releases retained metadata after collection. Abandonment relinquishes result interest and enters accounted draining; it is not proof of application cancellation or rollback. Capability-bearing requests and replies are in scope. Source slots and receipts cannot substitute for owned live object bindings, rights, move-only custody and revocation lineage. Application objects, children and provider leases need their own producer disposition rules; the transport must report ownership transitions without claiming it can undo arbitrary application effects. ## Authority, security and reliability Admit work only through the caller's actual endpoint authority and bind delivery to the exact serving native process/generation and receiver context. A late completion must target its original delivery identity after receiver retirement or endpoint reuse; an endpoint number alone cannot select a later invocation. Reserve request, result, receipt, capability-custody and rollback capacity before externally visible acceptance. Admission failures preserve original caller ownership. Rejected collection preserves native result custody and installs nothing. Transfer validation preserves exact move-only rules and attenuated rights; revocation must not recreate a removed alias. Kernel-owned escrow must expose no root CSpace, CNode handle, general object selector or fallback authority. Caller and server exit, cancellation, partial delivery, failed result copy and uncertain cleanup retain a named native owner and first error. Ordinary success and reusable identities require their own completed transition. Existing application cancellation/lease protocols remain separate. Process and invocation identities must not wrap onto retained state. Security and reliability gates precede allocation or throughput optimization. ## Acceptance criteria - Document the complete client/server state machine, native object ownership, error precedence, transfer disposition and producer migration before assigning ABI numbers. - Prove actual native request delivery and result collection with two distinct caller processes and a real serving process; inspect exact bytes, actual process generations and capability receipts. - Prove caller storage can cease to be the request/result backing after successful ingress; later peer work uses native-owned storage and collection uses a freshly admitted buffer. - Test wrong caller/server/generation, foreign selectors, premature or repeated collection/acknowledgment, replayed completion and endpoint reuse. No extra grant may appear. - Test copy and move-only transfers, attenuation, revoked escrow, occupied/out-of-window destinations, allocation refusal before admission, failed collection and cleanup after both peers' terminal transitions. - Distinguish transport draining from application cancellation and provider/child cleanup using real producer receipts. A payload-only model does not establish capability-bearing acceptance. - Run formatting, strict Clippy, warning-denied host/target builds, unit/doc tests and new VM coverage with original pinned sources. Preserve existing VM and unit regression gates during migration. - Profile admitted invocation allocation, copy volume and collection cost under declared budgets. Avoid repeated full capability scans and redundant payload copies when correctness permits; do not replace policy budgets with an incidental fixed table size. ## Alternatives and tradeoffs Retaining caller buffers until a peer finishes complicates independent scheduling and native lifetime ownership. A userspace-only result table cannot itself establish the kernel's transfer, delivery-identity and terminal guarantees. A request/result record containing only numeric former source slots cannot own a moved capability. A private per-invocation CSpace and a dedicated native capability-location abstraction are implementation candidates. The former can reuse existing transfer machinery but consumes existing CSpace/slot identity resources and needs exact teardown; the latter changes object-binding and revocation accounting more broadly. Select only after source-grounded ownership and resource experiments. Neither is adopted by this issue. Preserve narrow completion authority without turning a delivery token into a new general receive or process-control route. Allocator validation checkpoint — 14 September 2026: The allocator experiment removes live-table scanning and demonstrates allocation-failure identity preservation, but does not select escrow storage. A private empty CSpace does not pre-reserve every slot or typed binding. Existing transfer descriptor reservation is separate from payload/result and type-specific binding/rollback admission. The next design step must enumerate those contracts and define the full caller/server state machine before selecting a capability-location representation or ABI. No additional IPC experiment or vulnerability finding is claimed. Signed Kernel feature `ae0f3ab918abec71e809c3b4a68e54ec1c475e0d` carries original signed maintenance ancestor `41b57a7a67e6fee71f5708b55ab386b72366b8d8`. Both use the same CSpace allocator with their respective original dependency graphs. The feature tree equals the previously validated `e5198f8f3ce0dbc1ee3658cdd21bf10f0beed63c` tree. Strict development/release default/all checks pass: 613/637 units plus two standalone tests on the feature graph, 589/613 plus one standalone on maintenance, with three existing ignores. All eight feature and six maintenance freestanding builds pass without warnings. Kernel CI [536](https://git.erikinkinen.fi/erix/kernel/actions/runs/536) and [537](https://git.erikinkinen.fi/erix/kernel/actions/runs/537) pass with four complete logs, 643,867 bytes and zero warnings. The actual allocator rejection control fails the original signed library with next ID 5 instead of 4; the corrected test covers repeated failed growth, initialization failure and allocation-free reuse. ID exhaustion, duplicate destruction, occupied-record preservation and clean reuse pass. The same three-sample host profile reduces 32,768 reuse cycles at 32,768 retained spaces from 643.094176 ms to 1.172569 ms; host elapsed only, with no exclusive-CPU or guest timing claim. Endpoint construction checkpoint — 14 September 2026: The focused [owned-invocation design](https://git.erikinkinen.fi/erix/kernel/src/commit/f6489ff3f8fea88a26dad232cc45d0deb33fa30e/docs/owned-invocations.md) defines actual caller/server generations, exact receiver registration, retained SEND carrier lineage, request/result byte and capability custody, fresh collection, exactly-once grants, invalidated deliveries, draining and terminal cleanup. It enumerates cumulative type-specific binding reservations and no-allocation rollback obligations. The owned transport remains unimplemented; no new opcode, wire layout or escrow representation is assigned. This is a deliberate construction boundary cleanup, not a demonstrated vulnerability finding. Signed Kernel `f6489ff3f8fea88a26dad232cc45d0deb33fa30e` carries original signed ordinary ancestor `c7f8952c45a60ca451466d9731207c0a9a6a9a82`. Its feature tree equals the validated `fc3e1d5ea095fd17a9629a87d05ddad0863435ca` tree. Copy, attenuated copy and move reject unbound endpoint metadata before destination installation; the original control materializes an endpoint and fails the new invariant. Explicit construction then preserves exact object identity and SEND-only rights. Positive fixtures now construct their intended endpoint kinds without widening rights or changing assertions. Strict development/release default/all checks pass 614/638 units plus two standalone tests on feature, 590/614 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [540](https://git.erikinkinen.fi/erix/kernel/actions/runs/540)/[541](https://git.erikinkinen.fi/erix/kernel/actions/runs/541) passes: four complete logs, 644,652 bytes, zero warnings. Earlier same-tree CI 538/539 also passes. Completed CI checkpoint — 15 September 2026: Signed Integration `a869a81eb406a4f027a2b5db573b6330ca114d94` passes both [1607](https://git.erikinkinen.fi/erix/integration/actions/runs/1607)/[1608](https://git.erikinkinen.fi/erix/integration/actions/runs/1608); signed endpoint-construction checkpoint `989d44d604d07c4c9bcc23264912bdf2076b99eb` passes both [1609](https://git.erikinkinen.fi/erix/integration/actions/runs/1609)/[1610](https://git.erikinkinen.fi/erix/integration/actions/runs/1610). Each run reports all 486 distinct VM scenarios passing, followed by the actual native lifetime scenario, physical/serial interactive checks and all four console modes. Rust and Markdown pass. The two six-log cohorts contain 26,769,289 and 26,769,316 bytes respectively, with zero warning candidates. The previously observed intermittent quota timeout remains documented without a causal-fix claim. These results establish the selected source checkpoints, not owned invocation transport, complete authority closure or either full in-EriX build generation. Native transfer preparation checkpoint — 15 September 2026: Signed Kernel `e91f47198748d8ce52fc7361f389836a6bc2a206` carries original signed ordinary ancestor `d2438c7e56c964a9c16720586cf718ec11e7cc0a`. The feature tree is byte-identical to validated `d58efd8df18d63e5b97228c066f6d7623202e6d4`. Complete destination slot, rollback, typed binding and revocation-lineage storage is reserved before native capability mutation; reservations accumulate across aliases of the same object. Preparation failure changes no capability inventory or unique-grant custody. Commit and pre-delivery rollback require no allocation under existing BSP serialization. Five actual-object controls cover a 62-capability mixed batch, real allocator rejection, exact backing and grant scope, nested revocation and same-CSpace transfer. The ordinary grant move now uses the ID-only lookup without cloning descendants or adopting the later lifetime representation. Independent strict development/release default/all checks pass 619/643 units plus two standalone tests on feature, and 595/619 plus one on ordinary, with three existing ignores. Eight feature and six ordinary freestanding builds pass without warnings. Kernel CI [544](https://git.erikinkinen.fi/erix/kernel/actions/runs/544)/[545](https://git.erikinkinen.fi/erix/kernel/actions/runs/545) passes: four complete logs, 649,206 bytes, zero warnings. Same-tree CI 542/543 also passes. This implements preparation for the current IPC path. Its private records cannot survive userspace scheduling and own no retained source authority. Persistent request/result bytes and capability custody, exact delivery state and terminal hooks remain unimplemented under [Kernel issue 11](https://git.erikinkinen.fi/erix/kernel/issues/11). No opcode, wire record, bootstrap-frame escrow eligibility or application-cancellation semantics are assigned. The renewed contributor-source inventory covers 76 repositories and 2,898 code files, all below 1,000 lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish whole-codebase authority or private-item documentation closure. Native invocation custody checkpoint — 15 September 2026: Signed Kernel `2e4deb7351184d3fe4517ce8d5d59eb9960f28ad` carries the native invocation core from `b1b632446ff5762761b5aee3fbdba320f5efff42` and the deterministic endpoint-fixture correction. Native Rust entry points implement explicit receiver registration, submit, claim, complete, fresh collection, progress, caller release and cleanup-only delivery relinquishment. They derive actual TCB/stage/CSpace identity, retain real request/result bytes and capabilities in a private CSpace, and keep a SEND-only carrier alias in its original revocation lineage. No CNode or private storage location escapes. Accepted results survive ordinary server death; repeated collection returns original descriptive receipts without reinstalling authority. Exact binding removal, process retirement and syscall-return hooks retain draining owners until native disposition and participant acknowledgements complete. Twelve actual-object controls cover caller/receiver scope, source-buffer mutation, duplicate destinations, moved unique grants and reused source slots, actual admission allocation rejection, six native object types, revocation, process death, replay and FIFO after registry vacancy reuse. The original draft FIFO control fails and the corrected selector passes. The disposal control proves actual guard revocation makes zero allocation requests; it does not prove a reachable backend disposal failure. Strict default/all development/release matrices pass 631/655 units plus two standalone tests, with three existing ignored experiments, private rustdoc, target Clippy and eight warning-free freestanding builds. [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13) retains CI [546](https://git.erikinkinen.fi/erix/kernel/actions/runs/546)/[547](https://git.erikinkinen.fi/erix/kernel/actions/runs/547): both fail the same older endpoint fixture at setup with 630 passed, one failed and three ignored. Four related fixtures reset CSpaces without resetting preceding non-root TCB attribution. All four deterministic original controls fail with CspaceSlotMissing; resetting attribution before CSpace replacement makes them pass without changing any message, transfer or backpressure assertion. The correction is confined to test setup and thematic test organization; production behavior is unchanged. Corrected signed-head Kernel CI [548](https://git.erikinkinen.fi/erix/kernel/actions/runs/548)/[549](https://git.erikinkinen.fi/erix/kernel/actions/runs/549) and Docs [859](https://git.erikinkinen.fi/erix/docs/actions/runs/859)/[860](https://git.erikinkinen.fi/erix/docs/actions/runs/860) pass. All 8 complete logs total 1,413,966 bytes, with zero final warnings. The terminal cohort is classified. The syscall wire adapter, fresh userspace buffer/fault/overlap validation, authenticated caller-origin delivery fields and actual CPL3 owned-invocation peers remain unimplemented. Reachable backend disposal-failure coverage, sustained invocation-workload profiling, realm producer adoption, whole-codebase authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire record is assigned; the existing CALL/RECV/REPLY ABI is unchanged. The refreshed contributor-source inventory covers 76 repositories, 74 Cargo manifests and 2,913 code files, all below 1,000 physical lines. All 92 library/binary roots and 62 standalone Cargo roots have direct missing_docs gates. These static checks do not establish full authority or private-item documentation closure. Delivery-origin contract — 15 September 2026: each successful native request claim will return the submitting process ID and its exact staged generation from the invocation's retained kernel actor. These use the same identity domain as CREATE_STAGED_PROCESS and the existing pending-caller observation, and contain neither a CSpace identifier nor a selectable capability. The kernel derives both fields at submission; payload bytes, receiving-process identity and equal numeric source slots cannot replace them. This is an attestation of the submitted request's origin, not a promise of later process liveness or authorization for a subsequent operation. Services must correlate it with their exact retained process/realm ownership and revalidate after blocking effects. The delivery selector remains independently bound to the serving process and receiver registration. Distinct actual submitters sharing a carrier must yield distinct correct origin pairs even when their payloads impersonate one another. No syscall number or wire layout is assigned by this native-field change. Authenticated delivery-origin checkpoint — 15 September 2026: Signed Kernel `69c5e1fe5ffa72522ff6611d8b2c0471e865115e` adds CallerOrigin to each successful native request delivery. The process ID and staged generation come from the retained submitting actor in the native CREATE_STAGED_PROCESS identity domain; payload fields, receiving identity and equal numeric carrier slots cannot replace them. The pair exposes no private CSpace, grants no authority and promises no later liveness. Services must correlate it with exact retained process/realm ownership and revalidate after blocking effects. A two-submitter control sends mutually impersonating payloads through the same real carrier and validates both actual origins plus independent caller-local selector refusal. All 13 native custody controls pass. Strict default/all development/release matrices pass 632/656 units plus two standalone tests, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Kernel CI [550](https://git.erikinkinen.fi/erix/kernel/actions/runs/550)/[551](https://git.erikinkinen.fi/erix/kernel/actions/runs/551) and Docs [861](https://git.erikinkinen.fi/erix/docs/actions/runs/861)/[862](https://git.erikinkinen.fi/erix/docs/actions/runs/862) pass. All eight complete logs total 1,414,891 bytes, with zero final warnings; the cohort is classified and stopped. The separate earlier fixture correction remains closed in [Kernel issue 13](https://git.erikinkinen.fi/erix/kernel/issues/13), preserving original CI 546/547 and corrected 548/549. Sustained invocation-workload profiling, syscall wire and fresh-buffer/fault/overlap validation, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm producer adoption, whole authority/private-rustdoc closure and both complete EriX-in-EriX build generations remain open. No new syscall number or wire layout is assigned. Native progress and cleanup still do not certify application cancellation. The renewed inventory covers 76 repositories, 74 Cargo manifests and 2,914 code files below 1,000 physical lines. All 92 library/binary roots and 62 standalone roots have direct missing_docs gates. Source hashes, clean feature branches, signatures and remote equality are verified; these static gates do not close full authority or private-item documentation audits. Native invocation workload profile contract — 15 September 2026: add a maintained host workload using actual kernel process, CSpace, endpoint and revocation objects plus public owned-invocation entry points. Measure queued-request progress, collected-result progress, repeated collection and full request cycles against explicitly selected retained populations. Separate setup, operation and cleanup durations; retain exact source/binary identity, parameters, actual completed-operation counts and independent caller-origin, FIFO, byte, capability, foreign-selector and final-disposal checks. Each sample uses one owned process and explicit inputs, deadlines and output budgets; no VM, network, signing credential or unrelated-process authority is required for measurement. Integration must retain complete process status and raw evidence, reject incomplete or mismatched samples, and report comparisons only for equivalent source/workload contexts. Build once per source into distinct targets and run uncontended before/after samples. Host measurements do not establish guest or self-host-build throughput. The current global registry and endpoint-binding scans are hypotheses until measured; any optimization must preserve exact identity, allocation-safe publication and accounted revocation/terminal cleanup. Ordinary functional tests gain no timing-ratio assertion. Native invocation profiling baseline — 15 September 2026: Signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` provides an actual-object host workload for queued progress, collected progress, descriptive result reads and complete request/result cycles. Signed Integration `f3e4359b34cb8f7db732fbf38823f722553c86d4` adds bounded capture, raw-evidence report verification and equivalent comparisons. Every sample checks exact bytes and SEND capability bindings, authenticated origin, foreign selection, duplicate completion refusal, FIFO position reuse, one-time collection and final invocation disposal. Source and executable bytes are observed against explicit original identities; compiler/host relationships remain declarations. Workload children and source Git reads receive minimal environments; capture owns memory, time, output and process cleanup. Completion is published only after deadline teardown succeeds. The operator guide and signed Docs `644273a0edd91e4c38dcd4418d6ae1119ff1f10b` describe these boundaries. Kernel strict default/all development/release checks pass 632/656 units plus three standalone controls, three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. Integration passes all 161 helper commands, including 19 profiler controls and nine source-provenance controls, plus fresh strict 320/321-unit Rust matrices, private rustdoc and warning-free target builds. Four original socket-fixture failures are retained and attributed to the selected temporary directory exceeding the host Unix-socket path domain; a shorter explicit private directory passes the same fixtures. Docs passes 45 tests and renders 2,345 pages with zero final warnings; 427,592 word boxes fit page bounds and changed pages 2284/2285 pass visual review. Kernel CI 552/553 and Docs CI 863/864 pass; eight complete logs total 1,431,762 bytes with zero final warnings after manual reference convergence. The original signed Kernel baseline retains 48 measured samples and 16 checked warmups: four modes, populations 0/32/128/512, 256 operations per sample, three measured repetitions and one warmup. A single selected host CPU is used after local build/test work completes; external host scheduling is not isolated. At population 512, operation medians are 117,577.723 ns for queued progress, 8,927.977 ns for collected progress, 9,124.098 ns for descriptive reads and 1,167,847.016 ns for complete cycles. At population zero they are 223.328, 166.199, 213.137 and 4,556.867 ns respectively. Every raw sample, process disposition and final native cleanup passes. Timings include fixed semantic checks; no cost is subtracted and no ratio is a pass threshold. Source review identifies repeated carrier-binding scans during full registry refresh and a registry-lock acquisition for every inactive settlement position. The next bounded change will retain only non-authoritative numeric search positions: every fast path must still check current capability type/rights, endpoint identity/in-use state and exact CSpace/slot binding, with complete lookup on a stale hint. Existing revocation and terminal hooks remain authoritative. Settlement may scan for the next draining owner under one lock while retaining the original pass boundary, increasing index order, busy-position exclusion and allocation-free stack-owner return; disposal remains outside the table lock. Original workload bytes and sample policy must remain unchanged for comparison. No Kernel performance algorithm has changed in this baseline. Native syscall adapters, actual owned CPL3 peers, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The 76-repository inventory has 2,923 code files below 1,000 lines and 155 direct missing_docs crate-root gates; this does not close the semantic audits. Measured native invocation lookup refinement — 15 September 2026: Signed Kernel `8349d68636382cc7e25a3347f5f1df216554203a` retains only numeric carrier-search positions. Every use rechecks the actual CSpace capability type/rights, live endpoint identity and exact binding; stale positions take the complete search path. No successful authorization, capability or reference is cached. Draining scans fix their boundary on the first poll, visit each position at most once, skip busy stack owners and return exclusive custody after unlocking. Native disposal and first-failure retention preserve their existing semantics. Signed Integration `108501cf7ec20f05dd3d62ea401ea8adad6c6e9c` selects this Kernel in its isolated native catalog, and signed Docs `f10a1d375a326543ec0adda4569bc7cb4faca9b6` documents the invariants. The existing syscall ABI and ordinary image catalog are unchanged. All 15 actual-object native controls pass, including real alias compaction, rights/type/object replacement, busy ownership and allocation-free settlement. The unchanged four-mode workload control also passes. Full strict default/all development/release Kernel matrices pass 634/658 units plus three standalone controls, with three existing ignores, private rustdoc, target Clippy and eight warning-free freestanding builds. The existing native lifetime and entry-argument VM passes unchanged oracles in 21.978041 seconds of host build-and-run time, with clean teardown and empty QEMU stderr. Its signed boot image is 2,207,744 bytes, SHA-256 `4030cdfb8a13c000ff4716ecdc5203cb46273d6117a282f7375f25dccbbeedc9`. Exact unchanged Integration Rust/helper bytes preserve the preceding strict 320/321-unit matrices and all 161 helper-command results; changed catalog/scenario policies pass. Docs passes all 45 tests and a complete 2,345-page render with zero final warnings, 427,679 bounded word boxes and visual review of page 145 plus continuation page 146. The original signed Kernel `6cb703e1ed8b9de0d29a37189cd914cd501e732e` and the new signed Kernel use byte-identical workload sources, the same selected CPU/toolchain/context and explicit limits, distinct source targets, four modes, populations 0/32/128/512 and 256 operations per sample. Each capture retains 48 measured samples and 16 warmups; every sample passes actual semantic and native/process-cleanup checks. At population 512, median queued-progress cost changes from 117.578 to 37.673 microseconds (3.12x observed ratio), and full-cycle cost from 1167.847 to 443.055 microseconds (2.64x). Collected progress changes from 8.928 to 6.015 microseconds and descriptive reads from 9.124 to 6.212 microseconds. Timings include fixed checks, with no subtracted overhead or timing-ratio pass gate. No managed build/test workload runs concurrently during capture; external host scheduling remains unisolated. These are host operation wall times, not guest startup/build acceptance or a statistical guarantee. Kernel CI 554/555 succeeds; four complete logs total 679,280 bytes with no warnings, and its completed cohort is stopped. Docs CI 865/866 succeeds at observation three; four complete logs total 754,424 bytes, all 45 tests pass and each manual has 2,345 pages. Its normal reference passes report 32/1/0 warnings, with zero final warnings and no box diagnostics. The completed Docs cohort is stopped. Integration CI 1619/1620 is waiting at its first observation. Older Integration 1613/1614 is running; 1615/1616 and 1617/1618 are waiting. Accepted older Integration 1611/1612 passes all 486 catalog scenarios and later probes with complete warning-free logs. This does not establish the intermittent quota cause tracked in Integration issue 18. Current full-suite CI remains required; stopped cohorts are not polled again. Owned syscall wire adapters, actual owned CPL3 peers, fresh-buffer validation, reachable backend disposal-failure coverage, realm adoption, full authority/private-documentation closure and both complete EriX-in-EriX build generations remain open. The refreshed 76-repository inventory has 2,924 code files below 1,000 lines and 155 direct missing_docs crate-root gates; those checks do not close whole-codebase semantic audits. ### Owned invocation wire contract — 15 September 2026 This v1 contract connects the Kernel's native request/result custody to explicit userspace peers. It is tracked in [kernel #11][kernel] and [lib-ipc #1][ipc]. Shared codecs alone do not establish native execution or realm acceptance. ### Registers and ownership All numbers and packet fields are unsigned. Packet integers are little endian and require no alignment. RAX selects the syscall; arguments are RDI, RSI, RDX, R10, R8 and R9 in that order. Unlisted arguments must be zero. Return RAX is an ordinary IPC result code; RDX carries the operation-specific value below and R8 is zero. A rejected operation returns zero RDX unless SUBMIT explicitly reports a retained draining owner. Calls do not retain any userspace pointer. | Number | Operation | Arguments | Successful RDX | | --- | --- | --- | --- | | 0x4C | REGISTER | local RECV slot | zero | | 0x4D | SUBMIT | local SEND slot, input pointer, input length | invocation ID | | 0x4E | CLAIM | local RECV slot, receive pointer, receive length | delivery ID | | 0x4F | COMPLETE | local RECV slot, delivery ID, input pointer, input length | zero | | 0x50 | COLLECT | invocation ID, receive pointer, receive length | zero | | 0x51 | PROGRESS | invocation ID | packed progress | | 0x52 | RELEASE | invocation ID | packed transition | | 0x53 | RELINQUISH | delivery ID | packed transition | IDs are nonzero opaque numbers, scoped to the actual current process, generation and CSpace. They never choose a process or grant capability authority. REGISTER requires an existing generic endpoint. SUBMIT requires SEND and additionally GRANT for capability inputs. CLAIM and COMPLETE require the exact registered receiver and actual RECV; capability completion additionally requires GRANT. RELINQUISH acknowledges only an invalidated delivery owned by that serving process; it does not require a surviving receiver capability. RELEASE abandons future collection and starts native retirement, without undoing provider effects. SUBMIT may return a nonzero failure code AND a nonzero invocation ID: ingress could not be completed but native disposal remains accounted to that owner. It cannot subsequently be delivered. The caller must retain that ID for progress and release. A nonzero code with zero ID is an ordinary rejected submission. CLAIM/COLLECT return RAX zero after a committed delivery even if subsequent native disposal is draining; the receive header carries that distinction. Their rejection leaves the receive packet and destination inventory unchanged. COMPLETE accepts its result exactly once. Repeated COLLECT is descriptive: no second capability transfer, and the destination list must be empty. Packed transition uses bit 0 for draining and bits 32–63 for its nonzero native code; all other bits are zero. Complete is exactly zero. Packed progress uses bits 0, 1, 2 and 3 for request delivered, completion accepted, result collected and draining; bit 4 says a first error is present, with that nonzero code in bits 32–63. All other bits are zero. Draining may have no first error when release awaits server bookkeeping. Progress flags report history, not new authority. ### Input packet The fixed header is 40 bytes, followed by capability inputs and then payload. The exact packet size is `40 + 8 * capability_count + payload_bytes`. | Offset | Width | Meaning | | --- | --- | --- | | 0 | 4 | ASCII `OIV1` | | 4 | 2 | version, exactly 1 | | 6 | 2 | header size, exactly 40 | | 8 | 8 | payload byte count | | 16 | 8 | capability count | | 24 | 8 | maximum result bytes reserved by SUBMIT | | 32 | 8 | maximum result capabilities reserved by SUBMIT | Each capability input is a four-byte current source slot and four-byte requested rights. COMPLETE requires both result budgets to be zero. The kernel copies input bytes and retains actual admitted native bindings before returning; caller mutation or unmapping after return cannot change the accepted request/result. Possession, type, attenuation, provenance and lifetime checks remain native. ### Receive packet The fixed header is 64 bytes, then four-byte destination slots, then twelve-byte receipt capacity, then byte capacity. Its exact size is `64 + 4 * destination_count + 12 * receipt_capacity + byte_capacity`. | Offset | Width | Meaning | | --- | --- | --- | | 0 | 4 | ASCII `OIR1` | | 4 | 2 | version, exactly 1 | | 6 | 2 | header size, exactly 64 | | 8 | 8 | byte capacity | | 16 | 8 | destination count | | 24 | 8 | receipt capacity | | 32 | 8 | returned byte count, initially zero | | 40 | 8 | returned receipt count, initially zero | | 48 | 4 | attested caller process, initially zero | | 52 | 4 | attested caller generation, initially zero | | 56 | 4 | draining code, initially zero | | 60 | 4 | transition flags, initially zero; only bit 0 is defined | Destination and receipt capacities are distinct to support repeat collection. First delivery requires enough destinations and receipts for all actual inputs; only the used destination prefix is validated or populated. Spare destinations and unused receipt/payload capacity remain unchanged, acquire no authority and are not returned as evidence. A receipt is destination slot, native capability type and admitted rights, each four bytes. It describes a committed transfer, not a transferable capability. CLAIM supplies the retained caller's process and generation. COLLECT leaves those two fields zero. No caller-supplied identity is accepted. Output counts must fit capacities; draining requires a nonzero code. ### Validation and lifetime Overflow, size mismatch, noncanonical headers, unsupported versions, nonzero initial output fields and reserved register inputs reject before native custody changes. There is no inherited 32 KiB CALL limit. Actual addressability, native CSpace limits, caller budgets and fallible allocation still constrain admission. The entire input span must be freshly readable; the entire receive span must be freshly readable and writable in the current process's actual VSpace. Kernel, noncanonical, stale, overflowed and partly inaccessible spans reject. Mapping validation, packet admission, native effects and output publication share one existing process-lifecycle exclusion interval. All allocation and fallible output checks precede native delivery. Destination input is snapshotted before outputs are written. No userspace pointer, borrowed descriptor, receiver-selected CSpace or ambient allocator/provider authority enters retained custody. Hosted raw-pointer dispatch is refused; safe codec/object tests and actual CPL3 tests provide distinct evidence. Existing CALL/REPLY semantics remain unchanged. ### Acceptance and rollout Literal packet fixtures, arithmetic/malformed negatives, complete and draining returns, spare destinations, repeated collection, exact-owner refusal, revoked bindings, fresh mapping checks and real CPL3 request/capability round trips must pass. Existing unit and VM regressions remain mandatory. Producers and consumers select original signed commit pins after strict validation. Realm lifecycle and complete in-guest builds remain separate gates. A peek/sizing syscall is avoided by admitting capacity; numeric identities never bypass native ownership checks. [kernel]: https://git.erikinkinen.fi/erix/kernel/issues/11 [ipc]: https://git.erikinkinen.fi/erix/lib-ipc/issues/1 Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel `5f497adaefa526108a0439e0e071717dddb85334`, shared IPC `de968da19898bef532ddb3b5974bb9562f51dee5`, capability ABI `a001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0` and Integration `9030b217c490db6ad3ec60a799cb025eccbfcdb1` implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256 `588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333d` and `8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673` respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs `46da7a4cb4d38a2bea5b5491a68f51f33e4b4305` publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed. Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required. Process-bound native acceptance — 15 September 2026: Signed Kernel `60da5858d7198185efd103f0e91e5ac2e0b63e67` implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procd `f1105706cc19ed024a6cca79a29abc57c90c6661` uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPC `c453b697b8cdb9cc1c36f1ad89ff868648190025`, capability ABI `fe8d558253ad01301b99554e20d287c4ea35bb1d` and five aligned helper commits preserve original Git/type identity. Integration `58c925c564b69bebce8df6f3e75a9312824e18c4` passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is `8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e`; the unchanged owned-invocation scenario also passes with image SHA-256 `b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953`. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docs `b0fcf0f43af2af741d520a0b1373cc346e08863c` updates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result. Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements. ## Tracking and rollout Related: #1, #2, lifetime design #7, [Posixd design issue 1](https://git.erikinkinen.fi/erix/posixd/issues/1), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Sequence the ownership design, native mechanism, full request/reply capability tests, producer/consumer migration and real two-realm byte I/O. Keep ordinary source graphs coherent and never reinterpret existing reserved registers or startup fields. Remove superseded transport paths only after all owning consumers and regression gates migrate. The full build and second-generation build inside EriX remain separate phase acceptance gates.

erikinkinen added the

enhancement

performance

security

ci

phase-6

labels 2026-09-14 13:56:58 +02:00

erikinkinen referenced this issue 2026-09-14 14:29:11 +02:00

[BUG] Failed CSpace allocation consumes an identity before storage is reserved #12

erikinkinen referenced this issue from erix/posixd 2026-09-14 14:29:12 +02:00

[FEATURE] Implement isolated compatibility realms and exact grant lifecycles #1

erikinkinen referenced this issue from erix/posixd 2026-09-14 14:29:13 +02:00

[FEATURE] Audit authority, code quality and documentation in posixd #4

erikinkinen referenced this issue from erix/posixd 2026-09-14 14:29:13 +02:00

WIP: Specify staged mediator custody and realm bootstrap ownership #5

erikinkinen referenced this issue from erix/docs 2026-09-14 14:29:14 +02:00

[FEATURE] Enforce complete inline documentation and warning-free documentation builds #1

erikinkinen referenced this issue from erix/docs 2026-09-14 14:29:14 +02:00

[FEATURE] Audit authority, code quality and documentation in docs #2

erikinkinen referenced this issue from erix/docs 2026-09-14 14:29:15 +02:00

WIP: Document native authority and verify workspace and command evidence #4

erikinkinen referenced this issue 2026-09-14 14:52:31 +02:00

WIP: Enforce native lifetime and staged construction authority #3

erikinkinen referenced this issue 2026-09-15 04:10:28 +02:00

[FEATURE] Supply authorized memory, TLS, threads and race-free blocking for runtimes #1

erikinkinen referenced this issue 2026-09-15 04:10:28 +02:00

[FEATURE] Audit authority, code quality and documentation in kernel #2

erikinkinen referenced this issue 2026-09-15 05:18:38 +02:00

[BUG] Endpoint transfer fixtures inherit a previous non-root process #13

erikinkinen referenced this issue from erix/lib-ipc 2026-09-15 07:56:56 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-ipc #1

erikinkinen referenced this issue from erix/lib-ipc 2026-09-15 08:17:15 +02:00

WIP: Define native authority and staged construction contracts #2

erikinkinen referenced this issue from erix/lib-capabi 2026-09-15 08:17:16 +02:00

[FEATURE] Audit authority, code quality and documentation in lib-capabi #1

erikinkinen referenced this issue from erix/lib-capabi 2026-09-15 08:17:16 +02:00

WIP: Align capability layouts and staged authority contracts #2

erikinkinen referenced this issue from erix/lib-bootstrap 2026-09-15 10:04:45 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue 2026-09-15 10:04:45 +02:00

[BUG] Native lifetime fixture starts its observer before installing its context #14

erikinkinen referenced this issue from erix/lib-interrupt 2026-09-15 10:07:26 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-service 2026-09-15 10:07:28 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-time 2026-09-15 10:07:31 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/lib-log 2026-09-15 10:07:36 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue from erix/procd 2026-09-15 10:12:02 +02:00

WIP: Guard mediator construction and Launchd admission #2

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feature/posix-compat

feature/native-cli

feature/phase-4-audit

feature/dynlink

feature/program-loader

feature/e2fs-fat

feature/block-devices

feature/vfs

feature/centralized-process-authority

No results found.

Labels

Clear labels

  

bug

Something is not working

  

ci

  

docs

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

performance

Measured performance profiling, bottleneck analysis, and regression budgets.

  

phase-6

Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  

question

More information is needed

  

refactor

Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  

security

  

wontfix

This won't be fixed

No labels

bug

ci

docs

duplicate

enhancement

help wanted

invalid

performance

phase-6

question

refactor

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

erix/kernel#11

No description provided.