WIP: Enforce native lifetime and staged construction authority #3
No reviewers
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/kernel!3
Loading…
Reference in a new issue
No description provided.
Delete branch "feature/posix-compat"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary and rationale
Enforce process-bound grant custody, staged construction, endpoint attenuation
and owned invocation. Operation 54 creates a child with one primary endpoint and
no root capabilities while retaining native backing. Queries use actual caller
attribution and mappings retain explicit execution permissions.
Native syscall entry captures a complete initialized resume prefix in stable
kernel-owned storage before dispatch. Refusal cannot execute the requested
operation or select stale resume state. Exception entry preserves alignment and
exact hardware-frame extents; host fixtures own their complete stack windows.
VSpace cleanup records completed withdrawals and consumes successful frame
releases. Process abort and destruction now retain their empty private CSpace
through final VSpace release. Distinct cleanup states prevent restart, wake,
ordinary record mutation and live IPC admission. Identity reuse follows the
successful final commit.
Tracking and scope
Signed head
c55ee8d6f12957b43c5fd6aaf31c9865656b5ae6, branchfeature/posix-compat.Owning feature #1 and audit #2; bounded fixture issues #4/#5/#6/#16/#17 retain
their separate evidence. Dependent reviews:
Procd,
realm design,
Integration, and
manual.
Architecture, authority and failure behavior
Construction requires an actual Process endpoint; identities do not confer
authority. Grants retain unique custody, explicit rights, generation checks,
caller windows and rollback obligations. Omission of initial root capabilities
does not imply sealing or prohibit later authorized installation.
Retiring VSpaces refuse ordinary operations and new ownership. All access
withdrawals complete before backing release; completed effects are recorded.
Aborting and destroying processes remain distinct non-executable owners.
Final cleanup validates exact TCB generation and identities, then holds TCB,
CSpace, VSpace and allocator locks in that order. The final-release callback
cannot access TCB or CSpace tables. Failure retains the empty private CSpace;
success publishes its reuse and removes the TCB without another fallible step.
Earlier cleanup effects are retained, so this is not whole-process rollback.
Procd adoption, typed grant return, guarded bootstrap, mediator execution,
readiness, sealing, client I/O and fair retirement remain unfinished. Ordinary
mediator start gates remain closed. Complete semantic authority and source/frame
proof remain open; no generic syscall preservation mask is admitted.
Validation evidence
Original coherent realm source CI acceptance — 18 September 2026: Signed
bd127228f62cd5320e87642e79aa7c1cd8212e24passes CI 605 and CI 604. All four terminal logs are complete (738,372 bytes), with zero final warnings. This closes the original CI observation recorded above. Coherent catalog publication, actual consumer VMs and full guest-build acceptance remain separate open requirements.Original coherent realm runtime prerequisites — 18 September 2026: Signed
bd127228f62cd5320e87642e79aa7c1cd8212e24selects original shared dependency revisions. Four strict default/all-feature development/release matrices pass 702/726 kernel units plus two external controls per configuration, retaining three pre-existing ignored tests. Thirteen native builds cover ordinary, tracing, owned-invocation, lifetime and coherent SMP configurations. Formatting, strict host/native Clippy, private rustdoc and Markdown pass with zero warnings. Direct Rust implementation bytes are unchanged. Original CI is under observation. Matching catalogs, source-bound consumer VMs, complete realm operation and both full guest builds remain required.Explicit owned receiver admission acceptance — 18 September 2026: Signed
7034572037d1217b841c04dd9f45d5b254122a91. REGISTER binds explicit byte/capability request limits to the actual receiver generation and RECV binding. Zero dimensions, exact repetition and conflicting changes are checked without additional authority. Oversize is refused before native request allocation, transfer or invocation acceptance. Checked packet descriptors feed native preparation without a redundant vector. Seven new host controls and four strict 702/726-unit matrices pass, with both standalone controls, eight warning-free native builds, Clippy and rustdoc. Both actual 60-second VMs pass; ten new CPL3 admission checks precede every existing ownership, mapping, origin, lifetime and retirement oracle. Original build outputs reproduce packaged artifacts; all fifteen native component signatures are verified. Allocation controls observe no requests on oversized refusal and equal direct-native/packet submission allocation. Original CI 602/603 passes from four complete logs (738,406 bytes), without warnings. Actual owned Procd/Launchd service adoption, consumer VM execution, complete realm fairness/readiness/sealing and both full builds inside EriX remain open.Caller-local grant relocation native acceptance — 18 September 2026: Signed Kernel
56d398e077c140c58e23f9cc2d8b79f19bc4cc2fimplements register-only syscall 0x54 using the actual Running caller, both admitted local slots and native unique install/revocation binding owners. Rights, child generation, installation scope and revocation lineage remain unchanged. Seven new host controls and all four strict matrices pass: 695/719 units, both standalone controls, eight native builds, strict Clippy, rustdoc and formatting. Both actual native VMs pass under their original 60-second limits. The lifetime fixture executes thirty-nine new CPL3 relocation calls before its existing installation, revocation, terminal, inventory, queue and page checks; user instructions validate results and observers never replace them. Normal stripping reproduces both packaged Kernel artifacts, and all fifteen original selected component trees are verified clean. Original CI 600 and CI 601 pass from four complete logs (731,632 bytes), without warnings. This is native local custody evidence only: actual owned service adoption, consumer VM execution, complete realm fairness and both full builds inside EriX remain open.Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision
bd81f0d8bbb3ce3d3e4d172667d1d12fbe155e6eis pushed. Native operations 56/57 match the original generation under the cleanup lock, preserve partial-disposal retries and retire selectors 8/35. Four strict host matrices pass 688/712 units plus standalone controls; all eight native builds and Clippy configurations pass. Both original 60-second VM scenarios pass. Nineteen actual CPL3 cleanup calls check malformed and retired selectors, stale identity, eligibility, repeated absence and preserved terminal evidence. All earlier lifetime oracles remain required; both packaged Kernels match their normally stripped original builds and all 15 component trees are clean. Formatting and Markdown checks pass. Original CI 598 and CI 599 passes; all four terminal logs are complete (725,508 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Coordinated terminal observation checkpoint — 17 September 2026: Signed revision
5b20519a72e1cbc797eb32a7687e78ac4a8a7133is pushed. Both actual native VM gates now pass. Nine CPL3 terminal calls check malformed nonconsumption, retired-selector rejection without a fabricated response, original exit/kill generations and canonical empty queue. Exact build artifacts and all native component checkouts are verified. Original CI 596/597 has complete warning-free successful logs. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.Native terminal generation implementation — 17 September 2026: Signed revision
5b20519a72e1cbc797eb32a7687e78ac4a8a7133is pushed. Native operation 55 captures the original TCB generation with exit/kill and preserves it across queued observation and ID reuse. Malformed waits cannot dequeue; selector 7 is retired. Four strict matrices pass with 686/710 units, host/native Clippy, rustdoc and eight native builds. The added CPL3 fixture checks every response word; corrected endpoint-refusal framing passes both native profiles. Matching native execution and coordinated consumer rollout remain in progress; runnable realm bootstrap and complete guest builds are not established. Original automatic CI is monitored without retries.independent CSpace preservation, restart/wake/attribution refusal, retained
terminal status, retry eligibility and empty-space admission. Four preceding
VSpace controls cover withdrawal progress and exact managed-frame ownership.
units, both standalone controls and three existing ignored experiments.
Formatting, private rustdoc, warning-denied host/native Clippy, eight native
builds/binary-Clippy selections, Markdown and source review pass.
exits and 60-second limits using
run-scenario.sh. Normal stripping reproducesboth packaged Kernels. Final edits affect only three rustdoc locations; all
non-rustdoc source lines agree, and final documentation/format checks pass.
Native artifacts retain candidate source scope. Exact signed-wrapper and
ordinary-image adoption are not established by these observations.
and PR CI 595 pass.
All four complete logs are classified: 722,414 bytes, zero warnings and
matching 684/708-unit results plus both standalone controls.
zero warnings and 680/704-unit results. Capture CI 590/591 passes with four
complete logs, 716,126 bytes and zero warnings. Earlier fixture cohorts and
their original failures remain retained; unchanged failures were not retried.
fault under their original source scopes. Integration CI 1651/1652 retains
full-catalog failures, including the newly recorded timeout in
Integration #61.
Both complete guest builds remain open.
Review checklist
Process-start census correction — 19 September 2026: signed Kernel
b762e19d0c16acd605d0f6123994a586cc6fcde1requires a successful install-grant absence census before process start. An unavailable census returns the existing refusal and preserves the whole staged child and grant state. Hosted controls cover unavailable census, actual grant disposal and malformed-target precedence. Normal bootstrap initializes tracking before admission; production reachability of the injected condition or a native authority escape is not established. Kernel issue 18 uses the canonical bug report and records the original failure and bounded correction.Four strict Kernel matrices pass 704/728 library tests and two standalone controls each; three existing ignored tests remain ignored. Formatting, strict host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass. Original Kernel CI 606 and 607 pass from all four complete hashed logs (739,843 bytes), without warnings.
Signed Integration
b65183ddb93eb4396d4140a002c3727fec42ff87selects that Kernel and the reconciled Docs7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, preserving all other catalog entries and all previously checked orchestration bytes. The matching guarded-preparation VM passes both unique markers and ordinary successful shell exit under unchanged 120-second hard and 45-second progress limits. All 106 artifacts, all 73 original component identities and the actual signed image are verified without warnings. Serial SHA256:a373a8ccd81ac3efbaa492cbf2e1f991f3cc34dcbf23a1435c1c48cd75cd5c1c(55,776 bytes); signed boot-image SHA256:3b88d37183cf36dcbd5f1105cc0fd86e79aa4489d311300003f3f362c24bcd0a. This remains an unstarted staging fixture. Normal native execution does not exercise the hosted unavailable-census condition.The prior complete 169-helper/four-matrix Integration evidence is verified against unchanged implementation bytes. Focused catalog/source checks pass, including 46 immutable-source and five tool-selection tests. An initial host fixture failure caused by disabling its deliberate Git replacement setup is retained; the established helper environment passes without altering product checks. The static census covers 3,127 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional crate roots; complete semantic authority and private-documentation closure remain open.
Original Integration CI 1679 and 1680 are queued. Earlier 1677/1678 remains queued and 1675/1676 is running. No unchanged workflow is rerun or cancelled. Complete mediator execution, full source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole acceptance item is newly completed.
Shared native terminal transition — 19 September 2026: signed Kernel
37d9c74d6d1209729c520a52a274c1646efe225cconsolidates exit and kill event reservation, lifetime preflight, exact-generation commit and receiver/invocation retirement into one documented implementation. Existing public behavior and root exit cleanup remain unchanged. Terminal state and actual resource destruction stay separate. This completes the terminal-refactor prerequisite in child lifetime design #19; it introduces no lifetime binding, new opcode or additional authority.Four strict Kernel matrices pass 704/728 library tests and both standalone controls, with three existing ignored tests unchanged. All thirteen native build/Clippy profiles, formatting, host/native Clippy and private rustdoc pass without warnings. Original Kernel CI 608 and 609 pass from all four complete hashed logs (739,870 bytes), without warnings.
Signed Integration
a62d1381f56a01afc692112d9b427205eaeb6a2eupdates both full Kernel selectors and five stale native diagnostic selectors while preserving source memberships and tested orchestration bytes. Both maintained native runners pass their original 60-second scenarios: lifetime revocation and owned invocation. Complete serial logs are retained (1,807 and 1,587 bytes), QEMU stderr is empty, and build warnings are absent. Packaged Kernel bytes match retained unstripped artifacts; all fifteen exact original component trees and signatures verify. Four current strict 320/321-test Integration matrices, native builds, formatting, host/native Clippy and private rustdoc pass. Seven focused source/native-policy checks pass; the complete 169-helper evidence remains hash-bound to unchanged implementation bytes.Original Integration CI 1681 and 1682 are queued; older corrected 1675/1676 remains running. The static census covers 3,128 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 170 direct missing_docs gates and 92 conventional roots. Full semantic authority and private rustdoc closure remain open. Native child-lifetime custody, running mediator lifecycle, full frame proof, upstream Rust/LLVM rebuilding and both full EriX build generations inside EriX remain required. No whole phase acceptance item is added.
Native child lifetime checkpoint — 19 September 2026: signed Kernel
1428885e6dimplements operation 58 using the actual Running caller, an exact Created child, independent Process authority and its real local install grant. It consumes only that grant, reserves cohort events before terminal effects, stops descendants before their supervisor and retains each bound child's cleanup duty and first failure independently of userspace survival. Return-boundary disposal closes outgoing accounting and respects current/active-interval protection. Fourteen new real-object controls cover refusals, rollback, nested stopping, a 257-descendant tree, late preflight failure, exact reuse and failed explicit abort after unlinking. Four strict 718/742-test configurations and both standalone controls pass; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Original Kernel CI 610 and 611 pass from four complete hashed logs, 751,929 bytes, without warnings.The matching maintained lifetime VM passes its original 60-second scenario with the additional
ERIX_KERNEL:CHILD_LIFETIME_OKmarker. A real CPL3 supervisor proves ChildPopulate refusal, malformed/generation refusal, actual Process-route binding, start and exit. An independent observer verifies both exact children, CSpaces and mappings absent before terminal-event consumption, then disposes the unbound supervisor. The runnable child has a faulting sentinel and intentionally does not execute. All sixteen additional mapped pages are disposed. The original owned-invocation VM also passes its unchanged scenario. Complete serial logs contain 1,838 and 1,587 bytes; QEMU stderr is empty and build warnings are absent. Packaged Kernel bytes match retained original unstripped artifacts and all fifteen selected component signatures verify. Lifetime serial SHA256 is012b46541b7c1c89d954cdbebda855037152a4e39ffad20ad7bdcc8c7b5c2572.This establishes explicit native supervision with actual caller-side CPL3 evidence. Executing-child, no-successor native idle, allocation/partial-effect failure coverage, Procd adoption, running-mediator failure, provider completion, complete source/effect/frame proof, upstream Rust/LLVM rebuilding and both full EriX-in-EriX generations remain open. Host idle controls do not establish native interrupt or wakeup behavior. No whole phase acceptance leaf is added.
Signed Docs 9ca5a5e811766a4506c0626cd58f8e228d0bacf8 updates the technical manual's native admission, preflight, stopping, partial cleanup and safe return/idle contracts. All 45 tests and the complete 2,425-page manual pass with zero final warnings. All 447,213 word boxes are in bounds and all three changed contract pages are visually reviewed. Shared API reference source is unchanged. Original Docs CI 981 and 982 pass from four complete hashed logs, 773,510 bytes. Both pass 45 tests and the complete 2,425-page manual. TeX pass warning counts are 36/1/0, with zero final-pass warnings; neither workflow was rerun or cancelled.
Signed Integration 581226ab5435dc66c6f93157606b6d4d83475b15 selects the coherent original Kernel/lib-capabi/lib-ipc graph and updated manual. All four current strict 320/321-test configurations, four native builds, fmt, strict host/native Clippy and private rustdoc pass without warnings. Source and updated native-policy checks pass; the full 169-helper evidence remains bound to unchanged orchestration bytes. The final post-VM changes select only the newer Docs revision and update roadmap status; native source catalog, scenario, runtime and orchestration bytes are unchanged. Original Integration CI 1683 and 1684 are queued.
Executing-child and terminal-reply checkpoint — 19 September 2026: signed Kernel dd9eace5 validates actual CPL3 nested-child execution and current-child ancestor termination. Synchronous control dispatch now ends its request borrow before effects and checks original caller identity, generation and terminal state before any response write. It keeps terminal completion in Kernel-owned result registers with zero reply length; ordinary native return switches away. A surviving caller retains its normal encoded response. Two focused actual-object regressions cover terminal request preservation and the surviving-caller reply. The dispatcher is split from the tracing/policy file. A supervisor binds and starts a child; that child binds a staged grandchild and kills its supervisor through its own explicit Process SEND route. Read-only witnesses require terminal caller storage to survive dispatch, then exact child/grandchild absence before the independent observer reads child-before-supervisor events. Both terminal payloads have immediate UD2 sentinels. An unrelated Created process retains its exact record, empty capability inventory and mappings until explicitly aborted. All four additional lifetimes and twenty-two mapped pages must be disposed for
ERIX_KERNEL:CHILD_EXECUTION_OK.Four strict Kernel configurations pass 720/744 library tests and both standalone controls; three existing ignored tests remain. Formatting, host/native Clippy, private rustdoc and thirteen native build/Clippy profiles pass without warnings. Signed Integration c14c5a61 requires the additional marker while preserving every earlier marker and the original 60-second limit. Both actual native scenarios pass, with 1,870/1,587 complete serial bytes, empty QEMU stderr and no build warnings. Packaged Kernel bytes equal retained original artifacts after normal stripping; all fifteen original source signatures verify. Lifetime serial SHA256 is
1b2f983239efca55c8bc0f6f08ee91cfdcd37d4d1f6951bbd740e4d9b45d1a2f. Four current Integration 320/321-test configurations, native builds, strict Clippy, formatting, private rustdoc and updated policy checks pass. Earlier 169-helper evidence is hash-verified against unchanged orchestration; it was not rerun for these scenario/catalog changes.Signed Docs b4b01d87 documents the executing-child observations and remaining limits. All 45 tests, the full 2,425-page manual, 447,382 word bounds and visual review of the changed pages pass, with zero final warnings. The API reference source is unchanged.
This extends native executing-child evidence; it does not establish no-successor native idle/wake behavior, provider completion, Procd adoption or a complete service lifecycle. The original install-grant constructor still gives
GRANT | MINTwhile binding needs onlyGRANT; move-only transfer preserves exact rights. Both diagnostic grants are consumed, but rights minimization remains an explicit audit follow-up. Full source/effect/frame proof, the Pagerd gate, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.Related implementation tracking: Kernel feature, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Original Kernel CI 614 and 615 pass from four complete hashed logs, 753,462 bytes, without warnings. Original Docs CI 983 and 984 pass from four complete hashed logs, 773,542 bytes. Both pass all 45 tests and the complete 2,425-page final manual; reference-resolution warning counts are 36/1/0, with zero final warnings. Original Integration CI 1685/1686 remains queued at its second observation.
Older original Integration CI 1678 passes all 489 catalog scenarios and both native Kernel diagnostics, then fails the development COM1 editor probe after its physical counterpart passes. Rust and Markdown pass. All three complete logs total 13,384,697 bytes with no warnings; the outer input status does not establish cause. The canonical bug report is issue 67, with bug/ci/phase-6 metadata. Earlier editor and filesystem failures remain separate. No original workflow was cancelled or rerun.
Native cleanup without a userspace successor — 19 September 2026: signed Kernel 2cf5b34c adds a seventh actual CPL3 caller to the maintained lifetime diagnostic. After every earlier assertion, the observer binds/starts the final child and yields. The child kills that supervisor through its own explicit Process SEND route. Immediate faulting sentinels forbid either terminal payload from resuming. Ordinary native return closes CPU accounting, detaches current attribution, progresses reclamation and finds no runnable successor.
A diagnostic-only read-only witness then requires empty CPU accounting, only terminal retained records, no bound cleanup duties or event reservations, exact child identity/CSpace/mapping absence and both unconsumed child-before-supervisor events. All six final child pages retire; three original unbound terminal records remain for prior assertions. The witness neither performs cleanup nor selects a process nor installs an interrupt.
ERIX_KERNEL:CHILD_IDLE_CLEANUP_OKprecedes completion before HLT, so actual hardware halt/wakeup remains a separate gate.Signed Integration 4d6f4fe8 requires the additional marker while preserving all earlier assertions and both 60-second scenario limits. Both actual native VMs pass: 1,905/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256:
4a7cba61f75f4eeac47896d165b8dbcd217e4c75e2a81c8ae0f29957facb929c. Packaged Kernel images match retained build artifacts after normal stripping; all fifteen original component signatures verify. Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Post-VM changes only select updated Docs in full catalogs and update roadmap status.Signed Docs 69466a64 documents the pre-halt boundary and consolidates stale status paragraphs. All 45 tests, the complete 2,425-page manual, 447,534 word bounds and visual review of pages 562–564 pass with zero final warnings. API reference source remains unchanged. The static audit passes 3,140 authored code files below 1,000 lines, 74 manifests, 259 full Git selections, 171 direct missing_docs gates and 92 conventional crate roots; semantic authority and complete private-rustdoc closure remain open.
Original Kernel CI 616 and 617 pass from four complete hashed logs, 753,458 bytes, with no warnings. Original Docs CI 985 and 986 also pass: four complete hashed logs, 773,510 bytes; both pass 45 tests and the final 2,425-page manual. Reference-resolution warning counts are 36/1/0 with zero final warnings. Original Integration CI 1687/1688 remains queued at its first observation.
Older original Integration CI 1677 is now terminal failure: all 489 catalog cases, both native diagnostics, development physical/COM1 editor and release physical editor pass before release COM1 fails. Rust and Markdown pass. Three complete logs total 13,385,246 bytes without warnings; bug 37 retains this evidence. Companion 1678's earlier development COM1 failure remains separate in bug 67; a common cause is unproven. No original workflow was cancelled or rerun.
Further native failure controls, grant-rights minimization, terminal accounting, Procd adoption and complete service lifecycle acceptance remain open. Existing install-grant creation still supplies GRANT | MINT while binding needs GRANT, so minimum authority is not claimed. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Native terminal-event allocation refusal — 19 September 2026: signed Kernel ba03995f extends the actual executing-child sequence with one deliberately refused heap allocation. Separate diagnostic preparation captures the original supervisor, child, staged grandchild and independent process records/capability inventories, then gives an empty event queue one-event capacity. No queued event or existing reservation is discarded. The first terminal-event reservation succeeds; the second arms exactly one null return from the real Kernel allocator. Ordinary collection growth and Process dispatch return RESOURCE_EXHAUSTED before any terminal effect.
Read-only witnesses require complete reservation rollback, an empty event queue, unchanged exact records and capabilities, and preserved code/stack/message mapping ranges. Actual CPL3 instructions validate the refusal reply before the next ordinary ancestor kill succeeds with allocation available. Every earlier terminal, descendant-disposal, independent-process and no-successor idle assertion remains required.
ERIX_KERNEL:TERMINAL_EVENT_RESERVATION_OKrequires one consumed allocator refusal and no remaining armed fault. Fault controls are absent from ordinary images; this covers injected allocation failure, not spontaneous heap exhaustion or independent resource-release failure. No witness supplies a syscall result, cleanup effect or scheduler choice.Signed Integration cf5b2f5f requires the new marker without changing either 60-second limit. Both maintained native VMs pass: 1,948/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is
d485019082175f769ecc2d406d88c6cc84a7df323605027663f5bcc79ca03ad9. Packaged Kernel bytes match retained original artifacts after normal stripping, and all fifteen original source signatures verify. Post-VM changes only select updated Docs in full catalogs and consolidate roadmap status.Four strict Kernel 720/744-test matrices, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test matrices, four native builds, formatting, host/native Clippy, private rustdoc and updated policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 62ba2ffa passes 45 tests, the complete 2,425-page manual, all 447,688 word bounds and actual visual review of pages 562–565, with zero final warnings; API reference source remains unchanged. The static audit passes 3,142 authored code files below 1,000 lines, 74 manifests, 259 full Git pins, 171 direct missing_docs gates and 92 conventional roots. Complete semantic authority and private-rustdoc closure remain open.
Original Kernel CI 618 and 619 pass from four complete hashed logs, 753,434 bytes, with zero warnings. Original Docs CI 987 and 988 pass from four complete hashed logs, 773,506 bytes: both pass 45 tests and the final 2,425-page manual, with reference-resolution warning counts 36/1/0 and zero final warnings. Original Integration CI 1689/1690 is queued. Earlier filesystem, directory, editor and full-frame regressions remain unresolved; original workflows were not cancelled or rerun.
The terminal-accounting audit confirms that ordinary Procd terminal handling queries original TCB counters after receiving its event, while automatic bound-child reclamation removes that TCB. Its separate private-mediator branch does not take the same query path; adoption must state which lifetimes require retained metrics and preserve their original generation without fabricated zero/wall-clock values. Independent release-failure coverage, grant-rights minimization, accounting, Procd adoption and full mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Independent native child release recovery — 19 September 2026: signed Kernel 82d88b60 extends actual supervisor-exit coverage with two deliberate refusals at the original staged child's final VSpace-release callback, after capability disposal and unlinking. The first error is KernelHeapExhausted, the second CspaceSlotMissing. Read-only observations around two ordinary CPL3 observer yields require the original full record, generation, abort custody and first error retained, an empty original CSpace and retained mapped backing. The independent running child must already be absent from native TCB, CSpace and VSpace directories. The selected child's earlier directory position ensures its failure preceded that independent disposal.
The third callback must perform normal VSpace release before all original terminal-event, generation and resource-absence checks pass.
ERIX_KERNEL:CHILD_RELEASE_ISOLATION_OKrequires exactly two refusals and complete eventual disposal. Fault control uses only atomics at the locked callback boundary and exists only in the isolated native diagnostic. No witness performs cleanup, supplies a successful release/syscall result or chooses a scheduler target. This establishes injected callback-refusal coverage, not an observed hardware or allocator malfunction. All earlier nested-child, allocation-refusal and no-successor pre-halt assertions remain required.Signed Integration 294a467a requires the added marker with both original 60-second limits unchanged. Both maintained native VMs pass: 1,988/1,587 serial bytes, empty QEMU stderr and no build warnings. Lifetime serial SHA256 is
606fff037be022c876220d8e8f329c9046ffea5dcdf80831026649aedfbe0b08. Packaged Kernel bytes match retained original unstripped artifacts after normal stripping, and all fifteen original component signatures verify. Post-VM changes only select the updated manual source in full catalogs and reconcile roadmap status.Four strict Kernel 720/744-test configurations, both standalone controls and thirteen native build/Clippy profiles pass; three existing ignored tests remain. Four strict Integration 320/321-test configurations, four native builds, formatting, host/native Clippy, private rustdoc and changed policies pass without warnings. Prior 169-helper evidence is hash-verified against unchanged orchestration. Signed Docs 2a0ccc1a passes 45 tests, the complete 2,427-page manual, all 447,789 word bounds and actual visual review of pages 562–565 with zero final warnings. API reference source is unchanged. Static audit passes 3,143 authored code files below 1,000 lines, 74 manifests, 259 original Git pins, 171 direct missing_docs gates and 92 conventional roots; complete semantic authority/private-rustdoc closure remains open.
Original Kernel CI 620/621 and Docs CI 989/990 pass from four complete hashed logs each (753,438/773,910 bytes), with zero final warnings. Current Integration originals are observed after publication. Earlier filesystem, directory, editor and full-frame regressions remain unresolved, with original evidence retained; no workflow is cancelled or retried unchanged.
The grant-rights audit confirms actual Procd derivation callers and exact GRANT | MINT receipt checks in Procd and Launchd. Grant authority minimization must coordinate those consumers and distinguish the grant's own rights from its installation ceiling. Original generation-bound terminal accounting, Procd adoption, provider completion, hardware halt/wakeup and complete mediator lifecycle remain open. Full source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain mandatory. No whole acceptance leaf is added: 15/460, 3.48% weighted.
Related: Kernel design, Kernel WIP PR, Integration WIP PR, manual WIP PR, and phase completion.
Explicit grant implementation progress — 20 September 2026:
Kernel commit 4a5333f760e258ebca23047a362d1cff4fded0c0 is signed and pushed. Creation preserves exact own grant rights, including zero. Derivation requires actual MINT and subsets of both own rights and installation scope. Zero-right custody still blocks process start until disposed. Four strict 724/748-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings; three existing ignores remain. Original CI 622/623 passes from four complete hashed logs, 756,715 bytes, zero warnings. The new actual CPL3 derivation/disposal controls and GRANT-only relocation/installation compile; their matching VM execution remains pending.
The consumer audit also identified Loaderd and Deviced receipt checks. Procd's move-only handoff cannot attenuate the original delegating grant: it now derives a GRANT-only final receipt into the already-disposed VSpace receipt slot and drops the source before returning that receipt. Nonderiving materialization and rootless mediator paths request GRANT directly. Partial failure retains original-generation rollback and all remaining local custody. Procd, Launchd, Rootd, Loaderd and Deviced pass their default unit suites; their full strict matrices and coherent guest validation remain open. Deviced bug 4 records a separately observed quarantine test race and its test-only serialization correction.
This is partial implementation evidence, not completed lifecycle or self-hosting acceptance. The canonical checklist remains 15 of 460 leaves, 3.48% weighted. Full terminal accounting, provider completion, consumer lifecycle, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both complete EriX-in-EriX generations remain required.
Verified grant-rights checkpoint — 20 September 2026:
Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256
6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.All thirteen shared libraries pass their strict matrices and original CI. The five direct receipt consumers pass four strict host/native configurations; original CI passes for procd 292/293, launchd 145/146, rootd 1037/1038, loaderd 99/100, deviced 206/207. Rootd baseline regression and Deviced quarantine fixture race are corrected with retained original failures and successful corrected-source CI. Manual/API updates and remaining full-catalog alignment are in progress.
Integration bug 68 records five original CI failures (1683/1684, 1685/1686 and 1688), each with 127 manifest/catalog revision mismatches before full VM execution. All fifteen complete logs are retained, 1,512,137 bytes with no warning candidates. Individual-crate and minimal-native validation did not prove full catalog coherence. Remaining dependents are being aligned and validated bottom-up; equality and immutable-source checks are unchanged. Earlier 1681/1682 separately reached 479/489 and 487/489 VM passes, with ten and two scenario timeouts at the original 120-second bounds. Those filesystem failures require separate analysis.
Canonical acceptance remains 15 of 460 leaves, 3.48% weighted. Complete lifecycle and terminal accounting, provider completion, source/effect/frame proof, the 128-page Pagerd gate, profiler attribution, native external Rust/LLVM/runtime rebuilding and both full EriX-in-EriX generations remain required.
Verified native terminal accounting — 21 September 2026: Kernel a9bdf6163813d378e0b4a164bceb839e24fbb6b7 is signed/pushed. Terminal preflight reserves final scalar CPU evidence independently of TCB/CSpace/VSpace reclamation; exact queries preserve final results or explicit errors. Repeat observations belong to the actual original observer until exact acknowledgement, and observer death releases that claim. Independent authorized observers can progress. Selector 55 is retired; checked selectors 59/60 have no destructive fallback.
Four strict 736/760-unit configurations, both standalone controls and thirteen native build/Clippy profiles pass without warnings. Host controls include nonzero final counters after actual reclamation and ID reuse, original observer death, pending-final-charge destruction refusal, malformed requests, wrong callers, immutable errors and lost-acknowledgement reply retry. Original Kernel CI 624/625 and corrected 626/627 all pass from eight complete hashed logs (1,532,848 bytes), zero warnings.
Both maintained lifetime and owned-invocation VMs pass under the unchanged 60-second scenario limits and standard watchdogs, with no build warnings and empty QEMU stderr. Actual guest instructions check repeat observations and CPU queries, exact acknowledgement and absent-acknowledgement retry; executing children require nonzero user and kernel counters after native reclamation. Lifetime retains 2,025 serial bytes (SHA256
921edf5eadfdff61f2d85a63158555666e77e57a1e8aa4254ac30dcd216f8cf9); owned invocation retains 1,587 (SHA256404bc4ecad5074349d9ba45d1caf5439aebe849d344b726e5dec2ee2b9c4d907). Normal stripping exactly matches both packaged kernels to retained original artifacts; all fifteen selected original signatures and clean checkouts verify.Kernel regression 21 retains the first VM's final page-census failure. The corrected layout declares and allocates all six request pages and derives the independent census from that declaration. No unchanged retry or deadline relaxation occurred.
Integration fcd7b4a9608f629a12de78c53da5c3615d906b46 is signed/pushed with the verified isolated catalog. Twenty dependency and 46 immutable-source tests, native policies, Markdown and source checks pass. The unchanged orchestration crate, embedded fixture and original dependency closure retain verified four 320/321-unit and native/Clippy/rustdoc configurations. The full service catalogs retain their separately coordinated revisions; original Integration CI remains under observation.
Procd and Rootd consumer adoption, ordinary and mediator metric retention/consumer loss, manual updates, full service/profiler scenarios, complete authority/source/frame audits and full regression acceptance remain open under Kernel design 20. Canonical acceptance remains 3.48% weighted; 15 of 460 items. Native upstream Rust/LLVM/runtime rebuilding and both full EriX guest build generations remain mandatory and unproven.
Owned address-space preparation — 22 September 2026: Kernel issue 22 records the private hardware-root construction, exact authority, activation, invalidation, failure custody and retirement contract before implementation. Signed Kernel 5e818e8b6d1d, in Kernel PR 3, adds the design contract and an independent mapping-bit provenance regression. The current shared hierarchy and production permission encoder remain unchanged. An isolated rewrite produced the same 17 instructions and 63 bytes, so it was rejected as an optimization.
Four strict Kernel matrices pass 737 default / 761 all-feature tests in development and release, retaining the same three existing ignored cases. Formatting, host/native Clippy, all 13 native builds, private rustdoc and Markdown pass without warnings. Original CI 628/629 is running. No hardware-owned root, concurrent user execution, elapsed-time speedup or native isolation closure is claimed. The profiler and unchanged startup timing gates remain open in Integration 3 and Integration 72. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%; external Rust/LLVM rebuilding inside EriX and both full guest-build generations remain mandatory and unproven.
Native table-custody checkpoint — 22 September 2026: signed Kernel 2e744897de7c, in Kernel PR 3, gives unpublished table allocations one cleanup owner through translation and initialization. Empty-table installation and huge splits transfer custody at parent publication. The raw allocation-return helper and duplicate huge-split initialization are removed. Parent/leaf invalidation, interrupt masking, permission templates and current shared-hierarchy lifetime remain intact. Five host controls cover allocation/translation failure, invalid geometry, abandoned preparation and publication. Four strict configurations pass 742 default / 766 all-feature tests, retaining three existing ignored cases; formatting, host/native Clippy, private rustdoc and thirteen native builds pass without warnings. Original Kernel CI 630/631 passes from four complete logs, 771,607 bytes and zero warnings.
Signed Integration fe63adde8ff9, in Integration PR 12, selects that exact Kernel in all three catalogs. Every other selection and Kernel dependency manifest is unchanged. All 172 maintained helper commands pass without warnings; unchanged Rust inputs retain their preceding strict matrices. Three original-source native executions pass lifetime revocation, owned invocation and mapping checks with unchanged 60-second guest limits, warning-free builds and empty QEMU stderr. Mapping isolation and sparse mappings have identical runtime settings; both maintained marker contracts pass on the retained mapping capture. All fifteen selected component signatures verify, and each packaged Kernel image equals its retained artifact after normal stripping. These results cover the current shared hierarchy, not independent hardware roots.
The Kernel evidence update and Integration evidence update change documentation only, with executable inputs proven unchanged. Their original Kernel CI 632/633 is running and Integration 1715/1716 is queued. Older full Integration CI 1701/1702 at b06dfad00202765491a64552dde29eaca1c24838 passes from six complete logs, 26,962,712 bytes and zero warnings, including both runs' ext4 quota, ext4 links and FAT32 directory-metadata cases. Their earlier timing failures remain retained with unestablished causes; 18, 20 and 70 have exact follow-up observations. No workflow was rerun or cancelled.
All 3,176 authored code files remain below 1,000 lines. The next work in Kernel 22 must resolve the supervisor baseline, bootstrap/saved-frame overlays and inactive-space population before adding root ownership, residency and retirement. Startup timing acceptance, complete authority cleanup and the profiler's measured speedup remain open. The phase checklist stays at 15/460 accepted leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.
Ordinary mapping-domain checkpoint — 22 September 2026: resolved admission report records the original host failure and bounded fix. The fixture regression retains all three distinct failed attempts and the verified layout correction. Kernel now validates the complete ordinary user page before backing or mapping changes, with both control paths covered. Four strict 745/769-test configurations, thirteen native builds, Clippy and private rustdoc pass without warnings. Three exact-source native executions pass lifetime, invocation and mapping; four maintained scenario contracts are checked, with sparse and isolation sharing their identical runtime capture. All fifteen selected native signatures and packaged Kernel identities verify.
Integration pins the exact Kernel in all three catalogs, preserves every other selection and passes all 172 helpers. The unchanged ordinary exec-successor VM passes against the complete source graph, preserving its 120-second guest deadline, with no image warnings or QEMU stderr. Docs documents the domain and bootstrap distinction; all 45 tests and 2,431 pages pass, with 450,473 word bounds checked and no final warnings. The earlier Kernel CI 632/633 passes from four complete logs and zero warnings; current original CI remains under observation.
Bootstrap provenance, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Verified documentation and CI follow-up — 22 September 2026: Kernel documentation and Integration documentation record the accepted native mapping, three-grant cleanup and ordinary exec-successor evidence. Every executable file is identical to the tested implementation; Markdown and diff checks pass. All three failed fixture attempts remain in report 24, separately from the fixed admission defect. The complete manual passes 45 tests and 2,431 pages with no final warnings. The final static inventory covers 3,180 authored code files below 1,000 lines, 259 exact Git pins and the existing direct missing_docs declarations; it does not establish full semantic authority closure.
Original full Integration 1703/1704, source dff878dd3545c4751b3c05d37b2bdd5e21cce548, pass from six complete logs totalling 26,964,178 bytes and zero warnings. Their ext4 quota/links and FAT32 directory scenarios explicitly pass. Earlier timing failures remain retained and their causes are unestablished. Kernel 634/635 report cancelled, with runner context-cancellation messages and four complete logs. No cancellation request was issued during this work; the workflow declares no cancellation policy, and the initiating cause remains unestablished. These runs receive no CI acceptance credit. Current Kernel 636/637 and Docs 1007/1008 pass. Each pair has four complete logs: Kernel totals 773,796 bytes with zero warnings, and Docs totals 774,706 bytes with zero final warnings. Both manual builds retain their initial 35/1/0 LaTeX warning sequence through convergence. Integration 1717–1720 remains queued.
The phase checklist remains at 15/460 accepted leaves, weighted 3.48%. Private hardware roots, complete authority cleanup, measured startup improvement, native external Rust/LLVM/runtime rebuilding and both complete EriX guest-build generations remain open.
VSpace MAP authority checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Current local MAP rights now govern map, protection and unmap requests. Empty and MANAGE-only aliases are denied; MAP-only access remains valid. Four strict 750/774-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The Integration catalog selects the exact signed Kernel in all three catalogs and passes all 172 helpers. Actual CPL3 calls preserve the authorized RW/NX page across restricted-alias refusals and drop all five temporary grants. Three native executions cover all four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signed sources and retained packaged artifacts. The original exec-successor service VM passes against all 73 components with its unchanged 120-second guest limit. All image warnings and QEMU stderr remain absent. Manual validation passes 45 tests, 2,431 pages and 450,550 checked word bounds, with both changed pages reviewed and zero final warnings.
The static audit covers 3,181 authored code files below 1,000 lines, 259 exact Git dependency pins and existing direct missing_docs gates. It does not close semantic authority review. Earlier full Integration runs 1705/1706 are running; 1707–1720 remain queued at the latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 638/639 and Docs 1009/1010 pass. Each pair has four complete logs: Kernel totals 777,250 bytes with zero warnings, and Docs totals 774,674 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1721/1722 remains queued; it receives no CI acceptance credit.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX, then completing both full EriX guest-build generations, remains mandatory and unproven.
Frame access checkpoint — 22 September 2026: the resolved bug report records three original failing host controls and the verified correction in Kernel. Explicit READ now governs admission and hardware activation. No-access mappings retain backing with USER/WRITE clear and NX set; write-only and execute-only requests are rejected without adding READ. Existing protection-transition rules remain in force. Four strict 757/781-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The Integration catalog selects the signed Kernel in all three catalogs and passes 172 helpers. Twenty-four actual CPL3 calls preserve earlier witnesses and cover no-access protection, write-only refusal, MAP-only frame derivation, denied READ and unmap after both frame grants are dropped. Three native executions pass four maintained lifetime/invocation/mapping/sparse contracts with original limits, exact signatures and retained packaged artifacts. The ordinary exec-successor VM passes against all 73 components with its unchanged 120-second guest limit. Builds emit no warnings and QEMU stderr is empty. Manual validation passes 45 tests, 2,433 pages and 450,702 checked word bounds, with the changed page reviewed and zero final warnings.
Static review covers 3,182 authored code files below 1,000 lines, 259 exact Git pins and existing direct missing_docs gates. This does not close semantic authority review. Earlier full Integration runs 1705/1706 remain running and 1707–1722 remain queued at their latest original observations. No workflow was rerun or cancelled. Publication CI: Kernel 640/641 and Docs 1011/1012 pass. Each pair has four complete logs: Kernel totals 782,838 bytes with zero warnings, and Docs totals 775,110 bytes with zero final warnings or overflow. The manual retains its initial 35/1/0 LaTeX warning sequence through convergence. Integration 1723/1724 remains queued; it receives no CI acceptance credit.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Authorized protection restoration, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Ordinary protection contract — 22 September 2026: the runtime memory design now specifies in-place no-access/R/RW/RX changes using current VSpace MAP and exact selected frame authority, including same-backing aliases and complete backing checks. Preserve W^X, explicit READ, object kind, reference custody, error ordering and all native witnesses. Kernel-owned anonymous loader materialization and Process endpoint target scope retain separate audit obligations. The implementation and exact-source VM evidence are pending. This earns no canonical acceptance credit; external toolchain rebuilding and both complete EriX guest-build generations remain mandatory.
Current-grant protection checkpoint — 22 September 2026: the resolved device-backing report distinguishes its original metadata-authority inconsistency from the separate restoration feature gaps. The Kernel implementation permits representable no-access/R/RW/RX changes through current exact-backing grants and aliases while active or inactive. It removes historical access ceilings and original-slot equality while preserving current VSpace MAP, selected frame rights, kind/range/identity checks, W^X, explicit READ, backing custody and failure ordering. Four strict 766/790-test configurations, thirteen native builds, strict Clippy and private rustdoc pass without warnings.
The coordinated catalog selects that original signed Kernel in all three catalogs and passes all 172 helpers. Fifteen managed-frame calls and twenty-nine device/domain calls pass inside the original lifetime window and deadline. Actual user instructions write, execute, rewrite and execute managed RAM, check narrow alias authority and final disposal, while a reused device slot cannot authorize unrelated backing. Every prior marker remains required. Three native executions pass four original contracts with complete signed source and artifact checks; the ordinary exec-successor VM passes the full 73-component graph and original 120-second limit. Image warnings and QEMU stderr are absent. Manual validation passes 45 tests, 2,433 pages and 450,954 word bounds; both changed pages are reviewed with no final warnings or overflow.
Static review covers 3,184 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins and 174 direct missing_docs gates. Full semantic authority review remains open. Older Integration CI 1705/1706 has eleven real ext4 timeouts across eight scenarios, with complete retained logs and no accepted rerun. Their root cause and correction remain unresolved. Publication CI: Kernel 642/643 and Docs 1013/1014 pass. Each pair has four complete original logs: Kernel totals 790,650 bytes with 766/790 tests and zero warning candidates; Docs totals 775,150 bytes with 45 tests, 2,433 pages and zero final warnings or overflow. Retain the original 35/1/0 LaTeX warning convergence. Integration 1725/1726 remains queued and receives no completed CI acceptance. The separate older ext4 deadline report remains open.
Canonical acceptance remains 15/460 leaves, weighted 3.48%. Complete POSIX protection support, Process endpoint scope, independent hardware roots, complete authority cleanup and measured startup improvement remain open. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
VSpace ownership preparation — 22 September 2026:
Live VSpace records and production mapping tables are non-cloneable. Test observations contain descriptive metadata, synthetic selectors use independent tables, and leaf-encoder checks borrow live mappings under the record lock. Selectors accept only the mapping table they consume. Current grants, backing custody, first-match ordering, reference scans and hint visit-count controls remain intact; the rights control now uses actual activation/deactivation. The former whole-record snapshot helpers are removed.
Four strict Kernel configurations pass 766/790 tests with three existing ignored cases; thirteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. All 172 Integration helpers pass. Three exact-source native executions pass the four maintained mapping, sparse, invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Original 60/120-second guest limits, existing markers, exact component signatures and retained packaged artifacts remain required; image warnings and QEMU stderr are absent. No startup speedup or independent hardware-root acceptance is inferred.
The Kernel implementation and Integration source selection are published with Kernel validation evidence and Integration validation evidence. Continue under owned-root design 22, Kernel PR 3 and Integration PR 12. Publication CI: Kernel 644/645 pass with four complete original logs (790,604 bytes), 766/790 tests and zero warning candidates. Integration 1727/1728 remains queued and has no completed acceptance; earlier ext4 deadlines remain tracked in Integration report 73. Complete authority cleanup, external toolchain rebuilding within EriX and both full guest build generations remain open. Canonical acceptance remains 15/460 leaves (3.48% weighted).
Native occupancy diagnostic regression — 22 September 2026: the original failure is retained with exact signed source and packaged-ELF identity. The fixture maps a Kernel heap VA that the correct ordinary-domain guard rejects on the native upper-half heap. Host allocator addresses did not expose the mismatch. The correction must preserve the guard, 64-page/alias/hole/byte/cleanup controls and both maintained VM deadlines. The report was subsequently resolved by the verified recovery below. No canonical acceptance leaf closes.
Managed-frame diagnostic recovery — 22 September 2026: Kernel report 28 is resolved by the signed correction and coordinated catalog. The diagnostic admits an initially empty lower-half window while preserving the ordinary-domain guard and all 64-page, alias, hole, physical-byte and cleanup controls. The unnecessary heap allocation and raw-pointer cleanup state are removed, with expanded inline rustdoc.
Four strict 766/790-test configurations, fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. All 172 Integration helpers pass. Both maintained allocator scenarios pass independently with their original 60/120-second deadlines and complete markers; exact signed source and retained packaged-ELF checks pass. The ordinary exec-successor VM also passes against all 73 components. Image warnings and QEMU stderr are absent. The original failed native image remains retained; no unchanged rerun is used as the correction.
Static review still covers 3,186 code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Full semantic authority and inline-documentation review remain open. Older original Integration 1707/1708 both pass all 489 VM scenarios, Rust 320/321 and Markdown; six complete logs total 26,966,330 bytes with zero warning candidates. Publication CI: Kernel 646/647 pass with four complete original logs (790,634 bytes), 766/790 tests and zero warning candidates. Integration 1729/1730 remains queued and has no completed acceptance; earlier ext4 CI deadline failures remain unresolved. The separate supervisor physical-access window and independent hardware roots remain implementation work. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Supervisor physical-access window — 22 September 2026: the signed Kernel implementation shares one restoring supervisor scratch transaction between frame scrubbing and physical mapping-byte copies. Caller backing custody and page-table/interrupt custody remain live through byte access, exact leaf restoration and local invalidation. Scratch is released afterward; read aliases clear the write bit and all temporary aliases clear user access and set NX. The unreachable raw-VA fallback is removed, and complete preflight rejects missing or ambiguous backing metadata before any range effects. No new userspace operation or capability grant is introduced. This is preparatory work for owned address spaces; independent roots and their switching/reclamation proof remain open.
Eight added host controls cover geometry, permissions, preparation and partial-effect failures, restoration/release ordering, and malformed later-page metadata without partial reads or writes. Four strict host configurations pass 774/798 tests with three existing ignored cases. Fourteen native builds and binary Clippy profiles, formatting and host/native private rustdoc pass without warnings. The coordinated Integration catalog passes all 172 maintained helpers; its exact marker expectation is updated alongside the strengthened scenarios. Unchanged orchestration and profiler sources retain strict validation.
Six native executions satisfy seven maintained scenario contracts. Both allocator scenarios require the new same-VA/different-backing byte-and-leaf proof after complete cleanup, retaining every preceding marker and the original 60/120-second deadlines. Three further executions satisfy mapping, sparse, owned-invocation and lifetime contracts. The ordinary exec-successor VM passes against all 73 components. Exact original signed source, retained artifacts and packaged Kernel matches are verified; no image warnings or QEMU stderr were observed. These checks establish no performance improvement. The technical manual documents backing and scratch custody; all 45 document tests and the complete manual build pass without final warnings.
Static checks cover 3,190 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots. Complete semantic authority and inline-documentation review remain open. Publication CI: Kernel 648/649 and Docs 1015/1016 pass. Eight complete original logs (1,572,758 bytes) confirm Kernel 774/798 tests, 45 document tests and the 2,433-page manual. Initial TeX reference warnings resolve through normal multipass generation; final passes are clean. Integration 1731/1732 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Canonical acceptance remains 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and its runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.
Owned supervisor baseline — 22 September 2026: the signed Kernel implementation captures and verifies independently allocated supervisor tables before root VSpace creation, Rootd preparation and RAM seeding. Each copied page has one typed aligned Box owner before a parent references it; the recursive entry selects the copied root. Source boot/AP tables and mapped backing retain separate custody. User leaves, malformed geometry and invalid recursive identity are refused. Leaf permissions, cache policy and huge-page sizes are preserved; newly owned table branches use WriteBack and clear USER. Failed construction releases all unpublished allocations. This replaces a raw-pointer table-storage owner with shared typed storage and adds no unsafe Send/Sync implementation or userspace operation.
Eleven new host controls cover independent storage, allocation/read failures, invalid translation geometry, user leaves, recursive and huge-page errors, source-permission drift, retained owner links and table counts beyond the unrelated 64-page batch size. Four strict host configurations pass 785/809 tests with three existing ignored cases; fourteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The coordinated catalog passes all 172 maintained helpers. Both allocator scenarios require successful baseline capture before their original marker sequence, with capability grants and original 60/120-second deadlines preserved.
Six native executions satisfy seven maintained contracts: both allocator scenarios, mapping and sparse checks sharing identical runtime settings, owned invocation, lifetime revocation and ordinary exec-successor across all 73 components. Exact signed source and retained packaged artifacts are verified; no image warnings or QEMU stderr were observed. The technical manual specifies the custody boundary and passes 45 tests, complete 2,433-page generation, all 451,287 word bounds and changed-page visual review without final warnings or overflow. Static audits cover 3,194 authored code files below 1,000 lines, 75 manifests, 259 exact Git pins, 174 direct missing_docs gates and 93 conventional crate roots.
Publication CI: original Kernel push 650 passes and PR 651 retains the host fixture failure. Regression 29 is resolved by signed Kernel
12184850cd73: a deterministic private predecessor reproduces the original defect, and the corrected fixture passes the complete local matrix and push CI 652/PR CI 653. Four complete corrected CI logs total 807,886 bytes with zero warning candidates. Only host tests and roadmap change; validated production sources and all catalog selections remain unchanged. Docs 1017/1018 pass with four complete logs (775,122 bytes), 45 tests and the 2,433-page manual. Initial TeX reference warnings resolve before clean final passes. Integration 1733/1734 remains queued at the latest retained observation and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. The retained baseline is a construction prerequisite for owned address spaces. Per-VSpace population, CR3 activation, invalidation and live-root reclamation remain open, and no speedup is claimed. Full semantic authority and inline-documentation review also remain open. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and completing both full EriX guest-build generations remain mandatory and unproven.Huge-leaf geometry correction — 22 September 2026: the bug report preserves four original host failures and one passing WriteBack control. The signed correction separates PAT from physical address bits, preserves permissions/cache indices across both huge splits, and gives newly allocated tables WriteBack policy. Scalar and batched translation, split preparation, snapshots and baseline validation share the documented geometry. No new userspace authority, original native exploit or universal boot failure is claimed.
Four strict Kernel configurations pass 796/820 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: mapping and sparse, lifetime, invocation, both allocator checks and ordinary exec-successor across all 73 components. The new native witness verifies real 2 MiB PAT translation, splitting and complete restoration; host controls additionally cover 1 GiB. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and changed-page visual review without final warnings or overflow.
Publication CI: Kernel 654/655 and Docs 1019/1020 pass. Eight complete original logs (1,592,794 bytes) confirm Kernel 796/820 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1735/1736 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,197 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, live-root reclamation and full semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.
First-start register custody — 22 September 2026: the stack-domain bug report preserves three original host failures and one valid-stack control at unchanged production sources; the same four controls pass against the signed correction. Ordinary anonymous stack materialization now rejects addresses outside the existing user domain, and direct bootstrap writes require retained writable registered backing. Initial registers have Kernel-owned storage; stack preparation preserves the synthetic return slot, complete admission, startup arguments and rollback. The obsolete saved-frame user overlay and directory scan are removed. Complete external start-context admission and the separate bootstrap code/stack overlay remain distinct work.
Four strict Kernel configurations pass 807/831 tests with three existing ignored cases, including eleven new controls. Sixteen native builds and binary Clippy profiles, formatting and private rustdoc pass without warnings. The catalog passes all 172 maintained helpers. Six native executions satisfy seven original contracts: lifetime, invocation, mapping and sparse, both allocator checks and ordinary exec-successor across all 73 components. The new witness checks all original initial register words after two real user stack mutations and before ordinary syscall capture. Exact source signatures and retained artifacts pass, with no image warnings or QEMU stderr. The manual passes 45 tests, 2,433 pages and four changed-page visual reviews without final warnings or overflow.
Publication CI: Kernel 656/657 and Docs 1021/1022 pass. Eight complete original logs (1,600,791 bytes) confirm Kernel 807/831 tests, 45 document tests and the 2,433-page manual. All 74 initial TeX reference warning candidates precede clean final passes. Integration 1737/1738 remains queued and has no completed acceptance. Earlier ext4 CI deadline failures remain unresolved. Static audits cover 3,201 authored code files below 1,000 lines, 75 manifests, 259 Git pins and 174 direct missing_docs gates. Private root population, CR3 activation, CPU residency, live-root reclamation and complete semantic authority/documentation review remain open; no speedup is claimed. Canonical acceptance stays 15/460 leaves, weighted 3.48%. Rebuilding the external Rust/LLVM toolchain and runtime inside EriX and both full EriX guest-build generations remain mandatory and unproven.
WIP: Separate endpoint transport and receiver-scheduling teststo WIP: Stabilize kernel test isolation and split endpoint fixtureserikinkinen referenced this pull request from erix/integration2026-09-12 09:18:44 +02:00
WIP: Stabilize kernel test isolation and split endpoint fixturesto WIP: Stabilize kernel tests and measure mapping lookup workWIP: Stabilize kernel tests and measure mapping lookup workto WIP: Reduce managed-frame scans and stabilize kernel testsWIP: Reduce managed-frame scans and stabilize kernel teststo WIP: Reduce kernel handoff allocations and mapping scansWIP: Reduce kernel handoff allocations and mapping scansto WIP: Add native lifetime revocation and reduce handoff allocationserikinkinen referenced this pull request from erix/docs2026-09-14 10:13:48 +02:00
WIP: Add native lifetime revocation and reduce handoff allocationsto WIP: Add lifetime revocation and native custody validationWIP: Add lifetime revocation and native custody validationto WIP: Harden lifetime custody and preserve native entry argumentsWIP: Harden lifetime custody and preserve native entry argumentsto WIP: Harden lifetime custody and scale CSpace allocationWIP: Harden lifetime custody and scale CSpace allocationto WIP: Harden native lifetime and capability transferWIP: Harden native lifetime and capability transferto WIP: Implement owned invocation transport and native lifetime custodyWIP: Implement owned invocation transport and native lifetime custodyto WIP: Implement owned invocations and process-bound installationWIP: Implement owned invocations and process-bound installationto WIP: Enforce native lifetime custody and atomic process constructionWIP: Enforce native lifetime custody and atomic process constructionto WIP: Enforce native lifetime and staged endpoint authorityWIP: Enforce native lifetime and staged endpoint authorityto WIP: Enforce native lifetime and staged construction authorityView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.