[BUG] Native lifetime diagnostic suppresses required serial markers #9

New issue

Closed

opened 2026-09-14 11:19:46 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-14 11:19:46 +02:00

Owner

Summary

The new native lifetime diagnostic uses Rootd's filtered smoke logger for its required BEGIN and OK markers. Its feature selects the runtime and developer console, but the logger returns without output unless the separate Rootd smoke-test feature is also enabled. This prevents the isolated scenario from establishing its required evidence.

Reproduction

Build Kernel 213c4606b2bf94d7ed87f339bf4c7462cad90987 with kernel-bin,kernel-lifetime-revocation-selftest,kernel-dev-console. Run the isolated lifetime profile with Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5, one x86_64 TCG CPU and 1 GiB memory. One distinct VM at this corrected Bootloader revision reaches Kernel initialization and reproduces the missing-marker failure.

Expected and actual behavior

Expected: this explicit diagnostic emits exactly one BEGIN marker before user entry and one OK marker only after its complete native witness sequence and terminal state checks. Reporting must work independently of Rootd smoke logging.

Actual: QEMU returns the runner's expected debug-exit status, but the scenario fails with status 1 because ERIX_KERNEL:LIFETIME_REVOCATION_BEGIN is missing; neither required marker appears. Serial output reaches ERIX_KERNEL:SYSCALL_INIT_OK. The overall bounded command takes 27.211735 seconds and cleans up successfully. This is a failed scenario: a debug-exit status alone does not establish native acceptance.

Environment and identity

Kernel 213c4606b2bf94d7ed87f339bf4c7462cad90987; Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5; IPC de6892790de69f40f749c393d24078b287b36175; capability ABI 984c9f7b0ca910488f8c5b035d2f0cb88f18d304. Rust 1.97.1, x86_64 freestanding release image, signed with the explicitly selected Bootloader fixture key. No network or userspace I/O capability is granted. There is no earlier accepted native lifetime VM.

Evidence and prior checks

The isolated native mechanism is accepted at signed Kernel 03e13a784bde08914864267a4e2a6324a22d05c7, selected by signed Integration 4b65755f, with Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5, IPC de6892790de69f40f749c393d24078b287b36175 and capability ABI 984c9f7b0ca910488f8c5b035d2f0cb88f18d304.

Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture.

The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797. The 1,552-byte serial log has SHA256 8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9. The exact 15-repository graph and all 16 Cargo manifests are validated.

Push CI 528 and PR CI 529 pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass.

The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence.

The existing syscall and generated IPC manual is accepted at Docs 28b44183368c512da9c5b804f570ff497ae3b6fc with CI 839/840. The new native diagnostic and runtime namespace narrative is being validated in Docs. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open.

Source review identifies the exact kernel-rootd-smoke-test early return in rootd_smoke_marker. The full serial log, signed image, UEFI binary, closure report and true failed status are retained. Bootloader relocation now succeeds and Kernel entry is visible; Bootloader issue 5 is a separate corrected defect.

Pass a typed two-event reporting callback from the binary's existing serial output to the isolated fixture. Keep it in private Kernel-owned state, never in a user CSpace or payload; emit completion only after all unchanged witness assertions. Do not enable additional Rootd test features or weaken marker/deadline checks. Validate default/all-feature host and freestanding builds, sign the correction, and admit a newly built bounded VM.

Tracking

Related: native lifetime contract, Kernel PR 3 and Integration PR 12. Keep native and realm acceptance open until their complete scenarios pass; retain this failure separately from the earlier bootloader rejection.

## Summary The new native lifetime diagnostic uses Rootd's filtered smoke logger for its required BEGIN and OK markers. Its feature selects the runtime and developer console, but the logger returns without output unless the separate Rootd smoke-test feature is also enabled. This prevents the isolated scenario from establishing its required evidence. ## Reproduction Build Kernel `213c4606b2bf94d7ed87f339bf4c7462cad90987` with `kernel-bin,kernel-lifetime-revocation-selftest,kernel-dev-console`. Run the isolated lifetime profile with Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`, one x86_64 TCG CPU and 1 GiB memory. One distinct VM at this corrected Bootloader revision reaches Kernel initialization and reproduces the missing-marker failure. ## Expected and actual behavior Expected: this explicit diagnostic emits exactly one BEGIN marker before user entry and one OK marker only after its complete native witness sequence and terminal state checks. Reporting must work independently of Rootd smoke logging. Actual: QEMU returns the runner's expected debug-exit status, but the scenario fails with status 1 because `ERIX_KERNEL:LIFETIME_REVOCATION_BEGIN` is missing; neither required marker appears. Serial output reaches `ERIX_KERNEL:SYSCALL_INIT_OK`. The overall bounded command takes 27.211735 seconds and cleans up successfully. This is a failed scenario: a debug-exit status alone does not establish native acceptance. ## Environment and identity Kernel `213c4606b2bf94d7ed87f339bf4c7462cad90987`; Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`; IPC `de6892790de69f40f749c393d24078b287b36175`; capability ABI `984c9f7b0ca910488f8c5b035d2f0cb88f18d304`. Rust 1.97.1, x86_64 freestanding release image, signed with the explicitly selected Bootloader fixture key. No network or userspace I/O capability is granted. There is no earlier accepted native lifetime VM. ## Evidence and prior checks The isolated native mechanism is accepted at signed Kernel `03e13a784bde08914864267a4e2a6324a22d05c7`, selected by signed [Integration `4b65755f`](https://git.erikinkinen.fi/erix/integration/commit/4b65755f1f2774798d4a909212db4e64c0349b86), with Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`, IPC `de6892790de69f40f749c393d24078b287b36175` and capability ABI `984c9f7b0ca910488f8c5b035d2f0cb88f18d304`. Two private CPL3 owners execute actual syscall entry for refusal, consumed custody and repeated-slot denial. Ordinary exit and an independent observer's SEND-only Process endpoint exercise both terminal paths. Unchanged dispatch witnesses require exact generations and returns, cross-CSpace SEND/zero-right descendant absence, preserved independent aliases and exact terminal events. The fixture removes temporary CNode/TCB/VSpace handles before entry and retains its 16 owned code/stack/message pages until shutdown. It changes neither scheduler decisions nor production cleanup. Normal images exclude the fixture. The native scenario passes the required debug exit, ordered and unique begin/complete markers and all forbidden-marker checks. QEMU stderr is empty. The full build-and-run command takes 19.202361 seconds under the unchanged 60-second VM hard and 45-second silence limits, with one CPU, 1 GiB RAM, TCG and no network; this duration is not a guest performance measurement. The signed 2,142,208-byte image has SHA256 `4f021a40264739fef4979da2b0cd4647bde3f76b9dada6816aba6faa3594a797`. The 1,552-byte serial log has SHA256 `8cc7f9a7250881eddbc056834c46d7437ce944dd4b60c8b96e2c622bad2a85f9`. The exact 15-repository graph and all 16 Cargo manifests are validated. [Push CI 528](https://git.erikinkinen.fi/erix/kernel/actions/runs/528) and [PR CI 529](https://git.erikinkinen.fi/erix/kernel/actions/runs/529) pass for that signed Kernel. Four complete logs total 623,648 bytes with no warning candidates. Each test job passes 609 development-default, 609 release-default and 633 release-all units plus the three standalone executions; three existing experiments remain ignored per unit suite. Local strict default/all-feature development/release host and freestanding checks, private rustdoc, four native/normal builds and symbol exclusion checks pass. The failed pre-correction images remain retained: Bootloader issue 5 covers the runtime-name rejection; Kernel issue 9 covers markers suppressed by an unrelated Rootd smoke feature. The corrected entry point supplies a typed kernel-only begin/complete reporter without a new service route. Both defects now have exact-source CI and actual VM evidence. The existing syscall and generated IPC manual is accepted at Docs `28b44183368c512da9c5b804f570ff497ae3b6fc` with CI 839/840. The new native diagnostic and runtime namespace narrative is being validated in Docs. Integration CI 1603/1604 is running, including older VM regressions and the additional diagnostic. Realm producer migration, two-realms/two-clients actual byte I/O, pending-operation/provider completion, the complete authority audit and both full build generations inside EriX remain open. Source review identifies the exact `kernel-rootd-smoke-test` early return in `rootd_smoke_marker`. The full serial log, signed image, UEFI binary, closure report and true failed status are retained. Bootloader relocation now succeeds and Kernel entry is visible; [Bootloader issue 5](https://git.erikinkinen.fi/erix/bootloader/issues/5) is a separate corrected defect. Pass a typed two-event reporting callback from the binary's existing serial output to the isolated fixture. Keep it in private Kernel-owned state, never in a user CSpace or payload; emit completion only after all unchanged witness assertions. Do not enable additional Rootd test features or weaken marker/deadline checks. Validate default/all-feature host and freestanding builds, sign the correction, and admit a newly built bounded VM. ## Tracking Related: [native lifetime contract](https://git.erikinkinen.fi/erix/kernel/issues/7), [Kernel PR 3](https://git.erikinkinen.fi/erix/kernel/pulls/3) and [Integration PR 12](https://git.erikinkinen.fi/erix/integration/pulls/12). Keep native and realm acceptance open until their complete scenarios pass; retain this failure separately from the earlier bootloader rejection.

erikinkinen added the

bug

phase-6

labels

2026-09-14 11:19:46 +02:00

erikinkinen referenced this issue from erix/bootloader

2026-09-14 11:28:50 +02:00

[FEATURE] Audit authority, code quality and documentation in bootloader #2

~~erikinkinen referenced this issue from erix/bootloader 2026-09-14 11:28:50 +02:00~~

WIP: Preserve boot artifact and native entry contracts #3

erikinkinen referenced this issue from erix/bootloader

2026-09-14 11:28:51 +02:00