[FEATURE] Bind staged child cleanup to its native supervisor lifetime #19
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/kernel#19
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
A running realm needs a surviving cleanup owner when Procd terminates. Existing
Kernel lifetime custody retires a SEND lineage; it does not terminate a child,
destroy its receiver or reclaim its address-space backing. Rootd exits after
bootstrap. The minimum-bootstrap proposal
therefore keeps private mediator execution closed until child termination and
resource reclamation have an explicit surviving owner.
Proposed behavior and scope
Add an opt-in native custody operation through the existing Process control
authority. Bind one exact Created child/generation to the actual current Running
supervisor/generation, without accepting an externally named owner. Require
the real matching process-bound install grant and consume that grant only when
custody commits. A restricted install grant alone must not acquire termination
authority. Other live setup grants remain subject to the existing start census.
Custody is nonwithdrawable for that original child lifetime. Reject self-binding,
replacement generations, another owner, invalid states and cycles. Reserve all
record storage before effects; generation reuse cannot inherit a former binding.
Do not change ordinary unbound child semantics or allocate a new global route.
On the exact supervisor's terminal commit, native custody must prevent each
bound child from continuing execution and retain the obligation to retire its
actual resources. Staged abort, stopping a running child, terminal observation,
receiver/invocation retirement and final destruction are separate effects.
Do not free a current execution mapping during its terminal syscall transition.
Any deferred reclamation must have a native owner and a concrete scheduler
progress point; waiting for the dead userspace supervisor is insufficient.
Start with a shared terminal-transition implementation so exit and kill cannot
drift in event reservation, generation checks or retirement ordering. Define
cohort preflight, descendant traversal, event ordering and safe reclamation
before exposing the custody operation. The shared representation reserves native
control operation 58, BIND_CHILD_LIFETIME, and kill reason 4, SUPERVISOR_TERMINATED.
This reservation does not enable the operation in Kernel or authorize a consumer
to start a private mediator.
The request packs the nonzero child process ID and original nonzero generation
into the low/high u32 halves of arg0. Arg1 contains only the full u32 caller-local
install-grant slot; its high half, arg2, arg3 and flags must be zero. Slot zero
is valid at the representation layer. There is no owner field, rights mask,
unbind flag or transfer. Replies echo operation 58 and carry zero in both result
values for every result code. Unknown result codes remain uninterpreted.
Shared decoding rejects an unrelated selector, then reserved fields, then zero
identity components. Native dispatch must first authorize the actual Process/Root
route, then check framing, representability and the caller's slot window. Actual
current Running attribution, the real GRANT-bearing install capability and its
matching target record, and an unbound exact Created child are all required.
A derived install grant supplies only its original target evidence; Process
control supplies the existing termination authority. The binding stores exact
native generations and consumes only the selected actual grant upon commit.
It does not discard other setup grants or bypass their start census.
A duplicate binding cannot replace or withdraw custody. A missing grant after a
lost reply does not prove that binding failed. The caller retains its original
child/generation and must reconcile through existing exact staged abort or
terminal destruction as appropriate; it must not infer absence from a retry or
bind a replacement. A success reply proves custody admission, not child start,
terminal observation, provider completion or final resource reclamation.
The new reason describes a bound child stopped by native supervisor custody.
The root supervisor retains its own original exit/kill status. The detailed
native traversal, safe return boundary, idle progress and partial cleanup
implementation remain required before Kernel exposes operation 58.
Authority, security and reliability
The source of authority is the held native Process control capability, with
the actual install grant proving the selected staged target. The recipient is
Kernel lifetime custody; owner identity comes from current native attribution.
No process ID, lifecycle label, root path or child self-report supplies authority.
Reject unrelated endpoint policies and retain all original setup authority if
binding fails before commit. A lost response after commit must not permit an
unsafe resubmission or untracked child.
Each bound child and any pending cleanup remain tied to exact generations.
Preflight fallible reservations before terminal effects; preserve first errors
and unresolved obligations after commit. Never resume a child whose supervisor
has actually terminated, reuse its resources before acknowledged reclamation,
or call peer-dependent cleanup while holding a native lifecycle lock.
Bound traversal uses admitted object storage, without an incidental depth cap
or recursive stack growth proportional to a process tree.
Native child cleanup does not substitute for provider-specific operation
completion or revocation of independently exported aliases. Those remain
separately owned realm obligations. The existing implementation runs userspace
syscalls serially on the bootstrap processor; this work cannot claim concurrent
userspace SMP safety without separate evidence.
Acceptance criteria
committed-response handling and nonwrapping generation behavior.
including original event/receiver/invocation/lifetime controls.
a safe progress point after the currently executing instance becomes terminal.
duplicate binding, allocation failure, partial cleanup and replacement reuse.
nested bound descendants and preservation of independent unbound children.
retain original failures and unchanged hard/progress limits.
private rustdoc, warning-free builds and original automatic CI.
then validate running-mediator failure and both existing native diagnostic suites.
manual; keep full realm and self-hosting acceptance separate.
Alternatives and tradeoffs
Keeping another broad Process controller alive adds an unwanted global owner.
A mediator's promise to exit cannot survive its failure. Revoking only its
control SEND leaves execution and memory ownership unresolved. Automatically
coupling every ordinary child changes unrelated process semantics. The proposed
explicit native custody addresses only the selected child lifetimes, with
additional kernel bookkeeping and careful terminal/reclamation ordering.
Tracking and rollout
Native child-custody wire checkpoint — 19 September 2026: signed lib-ipc PR 2,
aaf2df39700b43507b23ff2007bc0d573c4eea30, implementsChildLifetimeBindingV1, native operation 58 and supervisor-termination kill reason 4. The request preserves the exact child/generation and actual local grant slot, with no owner selector, rights mask or withdrawal form. Existing Process authority and current Running attribution remain separate native requirements. All reserved bits are rejected; replies carry zero result values and preserve uninterpreted codes. Lost replies retain the original cleanup obligation. See the shared contract and Kernel design #19.Seven new controls pass all eight strict library/shim configurations: 419 wire tests and 20 shim tests per configuration, eight freestanding builds, formatting, strict host/native Clippy and private rustdoc, with no warnings. The original kernel-only shim test remains ignored. Original lib-ipc CI 365 and 366 pass from four complete hashed logs, 494,246 bytes, without warnings. Kernel admission, descendant stopping, safe native reclamation progress, coherent consumer adoption and actual CPL3 failure coverage remain open. The shared codec does not enable private mediator execution or alter the current complete image's source graph.
The matching signed Docs PR 4,
54557713f4afad380c1166f6aa1c1622d3959744, updates the TeX chapter and both IPC API views from original signed source. All 45 tests, independent API regeneration, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages pass, with zero final warnings. Original Docs CI 979 and 980 pass from four complete hashed logs, 773,034 bytes. Both runs pass 45 tests and the complete 2,423-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No workflow rerun or cancellation supplies this result. Native upstream Rust/LLVM rebuilding and both complete EriX build generations inside EriX remain required.Coordinate Kernel feature #1,
Kernel audit #2,
Kernel PR #3,
Procd design #1,
Posixd design #1 and
Integration completion.
Related existing SEND custody is Kernel #7.
No child-lifetime ABI or running-realm acceptance is supplied by this issue.
Configuration/seal, real clients, complete frame proof, upstream Rust/LLVM
rebuilding and both complete EriX builds inside EriX remain required.
Shared native terminal transition — 19 September 2026: signed Kernel
37d9c74d6d1209729c520a52a274c1646efe225cconsolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in child lifetime design #19; it introduces no lifetime binding, new opcode or additional authority.Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original Kernel CI 608 and 609 pass from all four complete hashed logs (739,870 bytes), without warnings.
Signed Integration
a62d1381f56a01afc692112d9b427205eaeb6a2eupdates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes.Original Integration CI 1681 and 1682 are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added.
Native child-custody dependency checkpoint — 19 September 2026: signed lib-capabi fbec4919371603044b9c4dd57a35c10633be314f adopts original signed lib-ipc aaf2df39700b43507b23ff2007bc0d573c4eea30 before Kernel adoption, preserving one immutable IPC source in the native dependency graph. All four strict 192-test configurations, four freestanding builds, formatting, host/native Clippy and private rustdoc pass without warnings. Original CI 244 and 245 pass from four complete hashed logs, 141,078 bytes, without warnings. Local capability policy is unchanged. Actual binding, descendant stopping, safe reclamation, coherent consumer adoption and CPL3 evidence remain open in Kernel #19.
Native child lifetime checkpoint — 19 September 2026: signed Kernel
1428885e6dimplements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original Kernel CI 610 and 611 pass from four complete hashed logs, 751,929 bytes, without warnings.The matching maintained lifetime VM passes its original 60-second scenario with the additional
ERIX_KERNEL:CHILD_LIFETIME_OKmarker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572.This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added.
Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.
Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.
Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for
ERIX_KERNEL:CHILD_EXECUTION_OK.Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is
1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.
This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives
GRANT | MINTwhile binding needs onlyGRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.
Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.
Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.
A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt.
ERIX_KERNEL:CHILD_IDLE_CLEANUP_OKprecedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256:
4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.
Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.
Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.
Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.
Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required.
ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OKrequires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is
d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.
Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.
The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.
The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass.
ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OKrequires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is
606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.
Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.
The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Explicit install-grant authority design — 19 September 2026: creation and derivation will request the returned grant capability's own rights explicitly, independently of its child slot/type/installed-rights ceiling. The native constructor must stop unconditionally adding GRANT | MINT. Zero means exactly zero rights; it never means inheritance. Only known rights valid for INSTALL_GRANT are admitted. Derivation still requires actual MINT authority and may request only a subset of the source grant's own rights and installation scope. A MINT-only source cannot recreate GRANT that it no longer holds. Genuine multilevel derivation remains possible through an explicitly delegating result.
The coordinated scalar layout uses the low/high halves of arg0 for grant slot/own rights on creation selectors 32 and 54, and source grant slot/result own rights on derivation selector 33. Other creation and derivation fields keep their existing meaning. A checked shared derivation representation will reject other selectors and reserved flags/high destination bits. Root-capability-free creation will expose the own-rights field alongside its existing explicit optional VSpace receipt. Existing zero high halves receive no compatibility default or implicit authority. Every actual emitter must be updated in the coherent original revision graph; no fallback to an older selector or looser receipt check is allowed.
Rootd and Procd will request MINT only for creation paths that actually derive installers. Procd's mediator creation and final installer handoffs will request GRANT without MINT; Procd and Launchd must independently validate actual capability/receipt rights rather than trusting request metadata. Native transfer remains move-only, preserves exact original scope and rights, and neither duplicates nor withdraws cleanup duty. Failed or lost creation/derivation replies must retain the original child generation and existing one-way rollback obligations. A zero-right grant still has its original record and must be dropped before start if it is no longer needed.
Required controls include exact zero/GRANT/MINT/GRANT | MINT requests; malformed/unknown/excess rights with no publication; ordinary installation and lifetime binding from GRANT-only authority; denial of further derivation without MINT; explicitly permitted narrower multilevel derivation; exact move receipts; preservation of source identity, generation and scope; occupied destinations and failure cleanup; and actual CPL3 coverage alongside all existing native allocation/release/idle assertions. Update actual consumers and their tests, the native policy, component architecture/roadmaps and the manual. Run warning-denied formatting, strict Clippy, unit and native tests, full manual checks and original CI; retain all pre-existing full lifecycle/frame/Pagerd/toolchain/guest-build acceptance gates. This design earns no completed acceptance leaf.
Owning coordination: Kernel lifetime design, Kernel WIP PR, Integration WIP PR and phase completion.
Explicit grant implementation progress — 20 September 2026:
Kernel commit 4a5333f760e258ebca23047a362d1cff4fded0c0 is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending.
The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. Deviced bug 4 records a separately observed quarantine test race and its test-only serialization correction.
This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required.
Verified grant-rights checkpoint — 20 September 2026:
Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256
6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. Rootd baseline regression and Deviced quarantine fixture race are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress.
Integration bug 68 records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis.
Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required.
Complete original catalog checkpoint — 20 September 2026:
Integration f9681efc30f1c48989def7f0e7db939974a30e27 is signed and pushed in WIP PR 12. Both complete catalogs now pass exact dependency equality against 73/70 clean original selected checkouts and 72/71 manifests; all 143 selected signatures verify. The original Integration library pin is retained independently of the catalog commit, avoiding a circular source reference. Twenty dependency-policy and 46 immutable-source tests, both native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Corrected-source original CI 1695/1696 is running; bug 68 remains open pending that observation and full consumer acceptance remains separate.
The executed inputs for both first-attempt native VM passes remain exact: 27 new ordinary CPL3 grant-right controls, every earlier lifetime/owned-invocation assertion, original 60-second bounds, zero build warnings and empty QEMU stderr. Both packaged kernels match retained original artifacts and all fifteen original source signatures verify. The final post-VM changes only select the full catalogs and reconcile documentation.
All 31 further fully validated consumer checkpoints pass four strict unit/native configurations and all 62 original CI runs; 124 complete logs total 3,041,213 bytes with no warning candidates. Their owning feature issues and WIP PRs preserve exact source and CI evidence. The full manual and regenerated IPC references are published in Docs WIP PR 4; its 45 tests, 2,429 pages, 448,913 word bounds and eleven changed-page reviews pass, as do original Docs CI 991/992 with zero final warnings.
Exsh dbc958bcdaa557a461e9308a31d23d3b8c189296 in WIP PR 3 is explicitly an incomplete-validation dependency checkpoint. Both development configurations pass 976 units, four native builds and strict Clippy/docs configurations pass, and all 355 checker tests pass. Three local release-unit compilation attempts reached the unchanged 120-second silence bound before tests ran. Four local frame checks return 1 with complete workspace mapping and 97/63 unresolved routes. Original CI 273/274 likewise passes 976 units and 355 checker tests, then fails the full frame/source gate with 101/68 unresolved observations. Four complete CI logs total 319,871 bytes with zero warning candidates. These local and CI artifacts are distinct; no frame or release-unit acceptance, relaxed deadline or unchanged retry is claimed.
Canonical acceptance remains 15/460 leaves, 3.48% weighted. The full in-EriX builds and native external Rust/LLVM/runtime rebuild remain unproven. Full consumer lifecycle, terminal accounting, source/effect/frame proof, the 128-page Pagerd gate and profiler attribution remain required; no canonical leaf closes at this checkpoint.
Verified managed installer recovery — 21 September 2026:
Signed Integration 648fbd5614d3d0b82223b1c3bb7f1b5a0c81ea7d in WIP PR 12 selects signed Procd ac8a12993bc8cbf134a11e141e459cb63df71123 and Docs PR 4. Both full original catalogs pass all 72/71 manifest checks against 73/70 clean selected checkouts and all 143 verified signatures. Twenty dependency and 46 immutable-source tests, native scenario policies, Markdown and whitespace pass. The unchanged orchestration crate retains its verified four 320/321-unit configurations, four native builds and strict Clippy/rustdoc evidence. Original Integration CI 1697/1698 is running; no complete regression-suite pass is claimed.
Procd bug 4 is corrected. The added producer regression reproduces the original 1056/1040 mismatch. Procd derives exactly GRANT into disposed VSpace scratch, drops its delegating source and uniquely relocates the result into the now-empty managed grant slot before handoff. The downstream TTY checks remain strict. Four 291/296-unit configurations, four native builds, formatting, strict Clippy and private rustdoc pass without warnings; relocation refusal and occupied-destination controls retain original-stage cleanup. Original correction CI 294/295 passes from four complete logs, 344,660 bytes. The subsequent roadmap-only checkpoint keeps every runtime source byte unchanged and original CI 296/297 passes from four complete logs, 344,680 bytes, zero warnings.
The maintained initial-shell start/exit, realm-admission and normal release-appliance VM scenarios all pass on their first corrected attempts with original guest bounds and watchdogs. The release appliance executes the real product-shell command and produces standalone LOOKUPOK output, separate from its echoed input. All three builds are warning-free and QEMU stderr is empty. Serial logs retain 55,702, 55,738 and 364 bytes respectively. Actual images, full artifact sets, scenario oracles and original signatures are retained. These runs execute Procd 10d972b652297fd656e9a6ac6dbdf197f362c7ce; the selected later Procd commit changes only its roadmap. All 73 executed component signatures and clean source trees verify. The earlier 431/489 and 430/489 full CI failures remain recorded, including the independent ext4 quota timeout; those runs are not rewritten as passes.
The native-launch manual now explains the managed return destination, exact rights, unique relocation and partial-failure cleanup. All 45 tests, the complete 2,429-page manual, 448,970 word bounds and changed-page visual review pass without final warnings. Original Docs CI 993/994 passes from four complete logs, 774,342 bytes; each final TeX pass is warning-free after normal earlier reference resolution. Existing generated API references are unchanged.
Canonical acceptance remains 15/460 leaves, 3.48% weighted. This is a repaired runtime regression, not completion of a canonical lifecycle leaf. Original-generation terminal accounting, provider/lifetime completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX build generations remain required. Exsh's retained release compiler and frame-proof failures stay open.