launchd

launchd is EriX's authority-aware native program launch broker. It validates streamed invocation intent, authenticates executable-bound manifests, derives the strict child-authority intersection, and orders loader/procd handoff without giving shell clients direct launch authority.

Running programs use an explicit job-bound broker for exact object demand and manifest-gated clock data. Kernel pending-caller identity checks prevent a forwarded bearer endpoint from impersonating its owner. Powerbox approval returns a revocable SEND alias through the blocked caller's reply; launchd never keeps a general-purpose installer for a running foreign process. Release, exit and replacement retain cleanup obligations until grants and provider objects are retired. Utilities own argument validation and ordinary failures; launchd does not interpret their names, operands or environment.

The runtime broker preserves NOT_FOUND only from an exact correlated, receipt-free powerbox resolution-absence decision after cleanup. Policy/user denial, missing internal identities, cancellation and uncertain protocol state remain denial or failure. A utility may request separate creation authority after absence; launchd does not infer or pregrant that operation.

An inherited-launch owner may explicitly loan its dynamic standard streams to a child through one SEND receipt per distinct description. Launchd creates a private child proxy using the existing endpoint pool; child CLOSE, cancellation and write-END never close the lender's backend. Exact live endpoint checks select local stream dispatch or the received external backend, with no guessed cleanup endpoint, reopened object or replacement PTY. Loans end when the lender dies: dependent children are stopped and their proxies retired before the lender's original cleanup proceeds. This bounded interface covers stdin, stdout and stderr; arbitrary extra-descriptor forwarding is not inferred.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

See:

• docs for system architecture and the technical manual
• lib-ipc for canonical launch, manifest, job, powerbox, and transcript records
• lib-capabi for exact launchd endpoint routes and startup transfer policy

Purpose of This Repository

This repository provides a no_std, allocation-free semantic core for native launch transactions. Runtime code authenticates capability receipts and object identity through the core's narrow query/retirement effects and supplies every mutable storage region described by the authenticated LCH1 startup record, including the exact architecture-bounded transient capability-slot base and count.

The maintained responsibilities are:

• reserve exact caller-sized storage for each declared launch transcript
• atomically reserve one exact consecutive launch-intake receipt range from the authenticated tail at BEGIN, return it only in the correlated success reply, keep concurrent transaction ranges disjoint, and skip every slot that still contains handed-off cleanup or other explicit local authority before reuse
• accept sequential fragments while hashing fragment-independent typed records
• require program, cwd, and direct-stream authority only on each record's final fragment; bind one exact normalized ENDPOINT SEND receipt to its role, live inventory, authenticated transient range, and transaction lifetime, while a description-backed standard role names one separately authenticated dynamic description and carries no duplicate stream receipt
• require canonical program, argument, environment, working-directory, stream, authority, and singleton script-envelope ordering
• derive the exact program, cwd, stream, child script-route bindings, and record counts from the committed transcript without copying or accepting out-of-band replacements; the program record also commits the child's TTY lifecycle destination
• bind manifests to the stable executable dependency-manifest identity selected from the authenticated runtime graph, loader-measured executable content, the complete runtime graph, domain-separated canonical command-directory-entry, and authority-table digests
• keep multicall entries isolated even when they resolve to one executable object: each exact entry accepts only its own sidecar and ceiling, with no cross-entry or combined-authority fallback
• reject absent sidecars before loader intake and reject malformed, stale, semantically impossible, unsorted, duplicate, or overlapping manifest rows before handoff or authority processing; a wildcard row is only an explicit ceiling over narrower authenticated session scope
• intersect invocation intent with authenticated session, manifest, and script ceilings
• permit exceptional authority only when every trusted approval gate opts in
• preflight every requested object against the authenticated manifest, script envelope, invocation flags, and complete ttyd ceiling before powerbox intake; scope-less selectors remain denied because powerboxd has no ambient namespace
• classify entry metadata reads and touch updates as exact directory-entry scopes, never as broad file metadata authority; accept them only with a one-shot invocation and one-shot manifest/script ceiling before any resolver or powerbox effect
• preflight every authority record before the first remote BEGIN, then retain only scalar launch state and immutable transcript boundaries; later work reconstructs and revalidates the exact selector rather than preserving a manifest or script-policy borrow
• resolve a program selector only through vfsd's private launch resolver after authenticating and attenuating the caller's explicit directory endpoint
• preserve only exact VFS executable-selector absence as searchable generic launch NOT_FOUND; preserve exact loader ELF rejection as the separate authority-free format class used for POSIX ENOEXEC fallback, while permission, identity, policy, and all other executable failures remain non-executable without disclosing or creating lookup authority
• resolve the executable and its .lmf sidecar from the same selector and explicit directory scope into disjoint provider-pinned receipt slots
• resolve the committed cwd selector only at the final pre-start boundary into a third provider-pinned, metadata-only, job-lifetime directory endpoint; retire the original scope immediately after resolution
• read manifest bytes only through the pinned sidecar endpoint's handle-zero read_at route, requiring sequential offsets, exact size, explicit EOF, and authority-free correlated replies; borrow the fixed reply in the caller's message arena and copy only its validated data prefix, without placing transport-sized owned responses on the runtime stack
• retain the executable alias across loader preparation, bind canonical path/mode/size/object evidence into the loader request, and release exact objects through vfsd before child provisioning or start
• query ttyd's private launch-policy route for the complete correlated parent session ceiling without receiving authority
• authenticate loaderd's atomic staged-process/grant reply, preserve the exact original procd grant destination and measured executable-manifest, executable-content, and complete-runtime-graph digests, and bind all of them to one launch transaction while the invocation-local VFS identity remains confined to receipt validation and release
• derive the exact canonical LCS1 version 1.8 size and SHA-256 from the prepared child's nonzero actual process ID and a distinct POSIX-visible ID: ordinary jobs derive the latter by checked addition above the complete 16-bit TCB namespace from the kernel's globally monotonic staged generation, bounded by signed-positive 0x7fff_ffff; exhaustion rejects launch without wrapping, while successor children inherit it from the exact published predecessor job. The image also binds the optional route-bound child script-envelope cross-check, the authenticated canonical command-entry digest, and committed argument/environment, shared-description, and sparse-descriptor records without allocation; retain each environment record's exact set/unset, export, and readonly bits as descriptive data; stream the canonical tables through procd's private receipt-free route, install either the provider-backed endpoint or exact prepared provisioned-stream sender named by each description into the staged generation before advancing, authenticate exact record/byte progress on resume, and commit the generation-bound child image before any TTY authority moves or process start
• create one resolver endpoint per job only after launch preflight, register only its attenuated RECV|GRANT with vfsd under the exact transaction/session/realm identity, and preserve the selected remote slot until exact unregister proves it absent
• construct procd's final complete cwd-plus-resolver-plus-script-route-plus- accounting-plus-lifecycle-plus-stream installation by moving only that exact grant, copying the resolved cwd, optional freshly created resolver and script senders, an accounting sender only when the authenticated manifest requests it, and complementary explicit streams in canonical order. Script and resolver senders are attenuated to SEND|GRANT: authenticated exsh SUBMIT calls may carry explicit child- capability records, while resolver calls transfer the already-authenticated cwd. A committed omit-child-cwd flag may suppress only the final cwd grant when both cwd and redirection-resolver child slots are zero; launchd still authenticates and resolves the cwd used to select the executable. Accounting, installed cwd, and streams remain exact SEND. The flow echo-correlates the TTY mask, then correlates authority-free exact-generation start or abort
• order other child capability installation, cleanup, and process start transactionally
• call powerboxd only through its authenticated private route: BEGIN, selector fragments, decisions, and cancellation carry no authority, while COMMIT alone copies the exact explicit scope into powerboxd's returned reservation; sequential requests may reuse that retained scope, and finalization or rollback retires it at the last pre-start boundary
• retain every attempted request, acknowledged selector offset, unknown reply, approved grant generation, and cancellation retry in deployment-sized generational state until a remote-terminal outcome is authenticated; resumed calls must reproduce the exact session, realm, job generation, staged process, operation, lifetime, class, flags, selector digest, source, and child slot retained at preflight
• drive retained BEGIN/selector/COMMIT/decision/cancel calls through that state, record an approved grant at its exact canonical handoff index before marking it installed, and accept cancellation NOT_FOUND only as authenticated proof that no remote request or grant remains
• retain an authority-bearing caller's COMMIT and transaction lease per ingress endpoint, accept only authority-free decision-ready wakes on the dedicated powerboxd route, re-read the exact correlated decision, and reply only after publication or complete authority-first rollback
• convert an exact process-generation terminal event into invocation/job grant expiration, retain ambiguous expiry replies for retry, and withhold job-route and job-record retirement until every matching grant obligation is gone
• poll launchd's private procd event queue only in zero/zero next-visible mode; launchd never supplies an arbitrary process selector, and the held private route remains the sole source of child visibility
• retain partial failures and exact capability slots in retryable cleanup state; accepted open descriptions move only their cleanup endpoint into the job ledger, which performs digest-bound idempotent VFS release after the exact child generation becomes terminal, while COMMIT continues to count the handed-off alias in the transaction's declared receipt total
• reserve deterministic non-aliased job-route slots from authenticated LCH1, create a mandatory status endpoint, only explicitly requested control endpoint, an optional script-launch endpoint, one private resolver pair, and a dedicated CPU-accounting endpoint only after an authenticated LMF1 flag requests it; drop any accounting creator after deriving exact child SEND and launchd RECV aliases. Status/control publication accepts the resulting all-zero accounting pair without manufacturing unused authority; partial accounting pairs remain invalid. Publish, register, or install only the role-specific attenuated handle without exposing internal job, process, session, loader, or procd identity
• prime every newly private launchd-owned job, script, accounting, and stream receiver before exporting its sender: copy the retained alias, perform one zero-capacity nonblocking receive, and require exactly empty RETRY. No buffer, message, or new authority is retained; failures use the existing preparation rollback. Resolver receivers delegated to vfsd are not primed by launchd, and temporary-source deletion preserves the retained receiver binding
• select the generic child ABI exclusively from the authenticated manifest: CPU accounting, inherited launch, wall-clock queries, session inspection, cwd, and redirection resolver are independent declarations. Inherited launch never implies either cwd or resolver authority; each needs its own flag. No executable-name, argv, or TZ parser runs in launchd. Nonempty authority tables or observation declarations select a fresh job-bound broker, never an unsolicited timed capability; the running program requests resources and handles its own errors
• retain the authenticated manifest and script ceilings (at most 16 rows each, with explicit capacity rejection), tty policy, measured process and canonical program identity, and protected startup-description count in the exact job. Only filesystem ceilings retain a separate cwd sender in the twelfth reserved slot; cleanup and successor replacement retire the exact provider object before slot reuse. A clock-only or inspection-only job retains no cwd scope
• implement receipt-free generic executable probing on the authenticated script route using the caller's exact currently held cwd receipt. The probe performs only scoped resolution and immediate object release: no launch, operand interpretation, grant, or retained query object. Cleanup uncertainty is fatal
• when an exact command manifest requires inherited script launch, accept the requirement only on an authenticated parent script transaction, allocate a collision-free descriptive envelope identity, and install a fresh child SEND|GRANT route whose stored rows exactly copy the parent ceiling with interactive escalation disabled; direct public launch and explicit-envelope substitution fail closed
• selectively admit session inspection on that existing accounting route only when the committed invocation explicitly requests it, the exact command-entry-bound manifest contains a non-interactive, job-lifetime INSPECT_PROCESS ceiling for the exact session selector, the authenticated tty policy admits the same operation/lifetime, and any active script envelope contains the same exact ceiling. No new capability is installed for this opt-in.
• reserve caller-sized stream endpoint pairs after every job route and before a mandatory nonempty intake tail; bind each pair to one transaction, nonzero stream identity, complete authenticated ingress/session/realm scope, exact here-document-reader or pipeline-reader/writer role, and unique child destination, then retain every attempted source/receiver cleanup until absence is proven
• accept authority-free provisioned-stream intent in one contiguous mixed namespace with provider-backed descriptions, without trusting stable record discriminant order. Intake authenticates exact role/access/body shape and a unique ordered child slot; committed planning binds correlation to the exact ingress, session, and realm, binds cleanup ownership separately to the exact transaction, and computes endpoint and immutable here-document storage demand before any endpoint-factory effect
• instantiate a disjoint caller-owned logical-stream table and compact byte arena from those authenticated capacities; reserve a complete intent before mutation, copy only selected here-document bodies, correlate pipeline roles only inside the full authenticated scope, close a terminal child role after its endpoint authority is proven absent, retain that exact role until job status observation so a later peer commit receives deterministic EOF or closed-reader status, and erase unowned bytes on explicit transaction retirement
• coordinate retained-state reservation and endpoint preparation atomically: preflight total endpoint capacity, reserve and copy all selected data before the first factory effect, prepare every canonical record, expose only exact SEND child transfers, and on failure erase all cleanly retired authority and transaction-owned data while preserving uncertain aliases for retry
• serve the generic ordered-stream ABI only on exact retained RECV routes: reject capability-bearing calls, enforce endpoint roles and exact offsets, apply partial writes against the current caller-owned free-byte count, bound reads by caller reply storage, and preserve explicit EOF, half-close, cancellation, peer-failure, and status transitions without silent loss
• bind each script envelope to a generation-safe session, realm, owning job and process, canonical manifest/session/parent ceiling intersection, and the launchd-retained RECV | GRANT route; GRANT is exercised only by exact capability-bearing COMMIT replies, the public route rejects script flags, and a numeric envelope ID is accepted only as an exact route-authenticated cross-check; an inherited envelope copies only its parent's authority ceiling and realm, then binds its private route to the child process's provisioned session so nested launches cannot reuse the parent or a sibling session
• mint a command-authority policy only while the exact retained envelope generation has an active transaction lease on its owning receive route; authority-bearing orchestration cannot accept a caller-constructed script policy or substitute a session, realm, route, or stale generation
• answer terminal status-and-times reads on the mandatory exact status route; pending work returns zero-shaped RETRY, while successful delivery returns child-plus-waited-descendant user/system totals and consumes the same job observation as the ordinary terminal status read
• answer receipt-free POSIX CPU-time reads only on each stable job's dedicated accounting route, deriving the stable job and exact process generation from endpoint possession; accumulate replaced predecessors into shell time and charge a child's complete nested totals exactly once after successful terminal-status delivery, with saturating arithmetic and zeroed failure replies. If termination wins a race with an already queued read, drain that authority-free request as NOT_FOUND without querying the retired process or treating the vanished caller as a service failure
• on an inspection-enabled accounting receiver, derive the caller session from the receiver-owned job, enumerate only published jobs in that session, and forward indexed CPU/memory snapshots through launchd's private procd sender. Process and job numbers are display data only; inspection returns no control handle, while cancellation and signals remain confined to separately held job-control endpoints.
• on an already-held exact job-control receiver, return only that route's descriptive session/job/current-process identity so a monitor can reconcile the handle with one inspection row. The request contains no target selector and the response transfers no authority; failures zero every identity field.
• carry only the validated inherited default/ignore signal set in launch transactions and canonical child startup images; caught shell action text never crosses the process boundary. The existing exact job-control route accepts a receipt-free canonical signal request, derives the process and generation from endpoint possession, forwards only that pair to procd, and atomically records the signal-derived status and procd's exact pre-destroy CPU snapshot without a second lifecycle call or relabeling cancellation. Signal reply delivery does not consume the independent terminal-status observation or charge waited-child CPU totals: an authorized control-only holder is not necessarily the original status waiter. A client that owns both routes must still consume its exact status reply before dropping them. Successful terminal-status delivery accounts the authenticated parent once; lost/failed status replies and ordinary grant/provider cleanup remain pending before receiver routes and job storage can be retired
• on a control-enabled job's independent status receiver, proxy one canonical foreground PTY event through the exact process generation already bound to that route and procd's retained lifecycle sender. The reply is receipt-free, failure preserves the cursor, and only the separate control receiver can mutate the job. A terminal-but-still-routed job returns event retry so its event read itself never consumes terminal status
• return the ordinary job's nonzero stable POSIX-visible process ID only when COMMIT explicitly requests it; the ID is stored independently of the recycled kernel TCB ID, survives successor adoption, and is also carried in every ordinary or successor startup image. Omission and every failure return zero, and the number confers no lookup, status, signal, cancellation, or other process authority beyond the exact routes separately returned to that caller
• run a bounded round-robin dispatcher across public and retained script launch intake, decision notifications, retained authority progression, exact procd lifecycle events, retryable unpublished-job and terminal-stream cleanup, retained ordered-stream receivers, and per-job control and status receivers; a delayed COMMIT blocks only its exact ingress endpoint, and a blocking receive that resumes with RETRY returns to bounded polling without discarding the transfer-bearing caller or treating the rendezvous as fatal

Selectors, session identifiers, digests, and numeric slots are data, not authority. The runtime must retain the real capability for every tracked slot until exact installation, transfer, or deletion succeeds.

The policy core admits a script command's ordinary grant only when its operation, object class, selector scope, and lifetime fit the retained envelope as well as the executable manifest and tty session. An empty envelope is deny-all. Authority outside the envelope remains exceptional: the request, transaction, manifest, retained script policy, and trusted tty session must all independently opt into interactive escalation.

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

The core forbids unsafe code, denies missing public documentation, and owns no ambient authority. Transactions, jobs, child-slot indexes, manifests, replies, and cleanup records use authenticated deployment storage rather than private logical-object ceilings. Full storage returns explicit backpressure or resource exhaustion without silently dropping bytes, status, or authority.

Repository validation requires:

cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
RUSTFLAGS="-D warnings" cargo test --all-targets --all-features
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features
RUSTFLAGS="-D warnings" cargo check --lib --target x86_64-unknown-none --all-features
RUSTFLAGS="-D warnings" cargo check --bin launchd --target x86_64-unknown-none --all-features

Status

Implemented:

• exact LCH1 startup and live capability-inventory validation
• fragment-independent transcript reconstruction and SHA-256 commit checking
• typed record ordering, contiguous indexes, and unique child installation slots
• stable executable-dependency-manifest-, executable-content-, complete- runtime-graph-, command-, and authority-table-bound manifests
• canonical committed program/cwd/stream planning plus domain-separated command entry identity derived from the vfsd-authenticated absolute entry path; lifecycle and selective TTY destinations come only from that committed plan
• logarithmic lookup over canonical nonoverlapping manifest/script ceilings
• fail-before-handoff manifest coverage for missing, malformed, stale, impossible operation/class, and wildcard/specific contradiction cases
• same-object multicall coverage proving read-only and mutation entries cannot validate each other's sidecars or observe each other's authority rows
• strict direct and trusted-approval authority intersection
• launch-side powerbox preflight plus exact begin/selector/commit/decision/cancel construction and reply authentication
• staged loader/procd/install/start ordering with counted cleanup obligations
• allocation-free launch-child startup sizing and hashing plus private begin/fragment/description-install/commit transport; fragments and description installs use disjoint alternating request IDs without a logical image-size ceiling, resume only from canonical procd progress, transfer only operation authority, reject reply authority, and configure ordinary and retained launch paths before TTY provisioning; BEGIN and COMMIT repeat the nonzero command-entry digest so procd reconstructs the exact authenticated child header
• exact paired vfsd artifact resolution/release and manifest reads, ttyd policy, loader grant, and procd TTY/start/abort receipt/live-slot validation
• framed vfsd/ttyd/loaderd/procd transports that preflight fixed slots, retire every unexpected receipt, preserve retry authority across failed exact-object release, move the install grant once, and exact-abort rejected staged work
• framed powerboxd transport that rejects and deletes every unwanted reply receipt, sends the sole scope receipt only on commit, and retains the exact authenticated source only until finalization or rollback has completed all sequential requests that share it
• generational powerbox lifecycle storage that distinguishes prepared work from unknown BEGIN/selector/commit/decision replies, preserves exact request-ID progress, binds every resume to the immutable preflight plan, and keeps failed grant cancellation explicitly retryable
• descriptive powerbox BEGIN context derived only from the VFS-authenticated canonical executable entry and exact job generation, retained after ordinary executable-capability retirement; caller labels never become trusted identity
• stateful powerbox call drivers that retain ambiguous remote outcomes, preserve the correlated source lifetime, leave pending decisions event-resumable, and join approvals atomically to the exact sequential handoff installation index
• exact receipt-free powerbox expiry transport and retained required/pending/expired transitions bound to the installed grant, owning job, and staged process generation
• authority-bearing staged-launch coordination that authenticates artifacts and session policy once, binds the optional script envelope, reserves one extra final TTY install after all canonical authority indexes, and returns on a pending decision for notification-driven resume instead of polling; after every approval it installs the final TTY at that reserved index and starts the exact generation
• authority-first staged rollback that retries every correlated cancellation, proves each local scope absent, and refuses to abort the process or release its unpublished job while any powerbox request or grant may remain live
• ordinary TTY launch orchestration that reserves an unpublished generational job only after it resolves and pins the executable and .lmf together, reads the exact sidecar, joins loader-measured executable/graph evidence to the canonical command entry, authenticates all five manifest digests, queries the correlated ttyd session policy directly, and retires both exact objects; only then does it begin handoff, provision final child endpoints, prove cleanup complete before start, or release cancelled unpublished jobs after rollback
• route-authenticated successor orchestration that accepts no requested authority or returned job routes, streams the predecessor's stable process identity into the staged child image, and crosses procd's exact stop-predecessor/start-successor operation only after every candidate input is configured. The envelope's route-bound child lifecycle session authenticates replacement and remains distinct from the stable public job's original caller session; the realm must agree across both. Pre-boundary rejection is classified by intent, route/owner/session authority, publication, lifecycle, approval, storage, or cleanup state and uses ordinary candidate rollback; a lost boundary reply or any later inconsistency fail-stops. Successful adoption asks vfsd to atomically move every predecessor-resolver stream record to the exact same-realm candidate resolver, moves matching cleanup obligations from the predecessor transaction to the successor transaction, and only then retires predecessor-only state and the predecessor resolver. A rejected pre-boundary candidate drops only launchd's duplicate cleanup aliases; the caller retains semantic provider cleanup so POSIX ENOEXEC fallback can retry the unchanged descriptions. Commit preserves the published job control/status endpoints and caller session, moves candidate process/resolver ownership into that stable job, and rebinds only the successor's authenticated script receiver
• exact-generation rollback that uses procd STOP as the reconciliation operation after any ambiguous start result, so the same request destroys an unstarted staged generation or terminates the already-running generation; transient STOP failure moves the unpublished job into retained cleanup instead of discarding process identity
• mixed TTY/explicit stream planning that preserves every final child destination, carries complementary explicit sources after the moved grant in stdin/stdout/stderr order, and retires all launchd aliases after the procd call. The selected TTY mask may be zero when stdin, stdout, and stderr are all authenticated explicit sources, so nested commands inherit their shell's exact streams without gaining a replacement TTY route. Execution accepts only the private authenticated-intake marker produced after exact role/range/live-capability receipt validation
• authenticated shared open-description intake that preserves exactly two send-only receipts, transfers only the operation endpoint to procd, keeps the cleanup endpoint out of the child image, and binds arbitrary sparse POSIX descriptor aliases to child-local description identifiers: zero through two name the implicit fixed stdin/stdout/stderr descriptions, while identifiers from three name the ordered dynamic description rows
• authority-free provisioned descriptions in that same canonical namespace, with no receipt intake, complete authenticated correlation scope, exact endpoint/here-document storage demand, atomic endpoint creation, and exact procd child installation through the fixed one-use staging slot
• caller-sized launch-stream endpoint-pair storage with generation-safe handles, complete source/receiver slot preflight, exact ENDPOINT SEND child transfers, post-delivery full-source retirement, reverse rollback, all-entry terminal cleanup, and retryable uncertain authority; authenticated version-2 LCH1 arena and CSpace wiring, ordinary and retained-authority launch preparation, plus abort/terminal dispatcher retirement are complete
• complete authenticated scope on every endpoint ledger row plus an allocation-free batch coordinator that checks endpoint capacity, reserves all logical state and selected bytes before capability creation, prepares records in canonical order, and rolls clean failures back across both ledgers; uncertain authority remains exact and retryable
• disjoint retained logical-stream metadata and bytes derived from the same authenticated LCH1 capacities, with complete-intent preflight, immutable here-document copying, cross-transaction pipeline correlation only by full authenticated scope, generation-safe inspection, compaction, and zeroed transaction retirement
• authority-free ordered-stream serving over exact live receive routes, with deterministic endpoint fairness, receipt rejection, exact role/offset checks, caller-sized buffering, partial write progress, receiver-sized reads, explicit EOF, directional close, terminal byte erasure, and observable status
• route-bound script-host creation that retains only the new endpoint's receive side in launchd, moves its send side once through procd, and reserves a deployment-sized generational envelope only after ttyd returns the exact child session identity; rollback removes both aliases and envelope state
• script transaction intake that authenticates the retained receiver before BEGIN, binds the exact envelope generation to the transaction, and requires the same receiver for every submit, commit, or abort so public and sibling routes cannot hijack retained work
• last-boundary cwd resolution that converts selector data inside the committed scope into one exact job-lifetime directory sender, preserves that sender for authenticated rollback after rejected or ambiguous procd results, and never treats an explicit redirection endpoint as path data
• retained x86_64 syscall binding for exact peer calls, local-capability query, and delete-until-absent cleanup
• authenticated x86_64 public launch dispatcher for BEGIN, record submission, COMMIT, and ABORT, with exhaustive surplus-receipt retirement, ordinary TTY launch execution, deterministic endpoint creation through launchd's separate endpoint-factory route, and exact control/status publication
• production public and script-route authority COMMIT retention that preflights all canonical records, stores only scalar transcript cursors, applies per-ingress backpressure, consumes powerboxd's authority-free wake, re-reads the authenticated decision, and resumes launch or rollback without polling
• fair post-start dispatch of correlated procd lifecycle events, cancellation, status reads, script transactions, and unpublished-job cleanup; owner termination first marks its script envelope retiring, drains exact retained transactions, removes the receive route only after the final lease, and then permits job-state retirement
• exact-generation live and terminal CPU snapshots through launchd's private procd route; every event, managed stop, rollback, and successor boundary observes the terminal record before reuse, while no script client receives a process identity or procd authority
• automatic terminal redirection release independent of status polling, while published job routes and terminal state remain until a caller successfully observes that exact generation
• exact job-resolver unregister on rollback and terminal teardown; retryable or ambiguous vfsd outcomes retain the authenticated remote slot and block job release instead of leaving residual namespace authority
• autonomous fair expiry of every installed invocation/job grant at the exact authenticated process boundary; terminal job status/control returns retry until powerboxd confirms EXPIRED or idempotent absence
• lossless retryable cleanup and generational job lifecycle tables

Authority-bearing public/script intake, post-start powerbox grant expiry, and exact job-retirement gating, stable replacement accounting, and waited-child CPU accounting are implemented. Focused end-to-end approval/denial/teardown VM validation remains for the native shell client that will exercise this route. Ext4 runtime-graph packaging and focused post-mount startup validation are complete. The focused launch-handle client fixture is now authored. Rootd owns only the initial exsh status sender; ext4 exsh observes /bin/false status one and forwards physical Ctrl+C to foreground /bin/cat through its independent control sender before observing status 130. QMP supplies no process or job selector, and neither child sender returns to rootd. Target execution evidence remains open until the focused VM can build and run with configured signing material. The one-shot invocation stopped before image construction because BOOTIMG_SIGNING_KEY was unset (passed=0 failed=1 total=1); it was neither investigated nor rerun. launchd must be installed on ext4 and started through the authenticated loaderd/dynlinkd/procd path after the root filesystem is mounted; it is not a boot.img service.

Governance Principles

launchd governs launch transactions, not shell parsing, terminal trust, filesystem namespace policy, dynamic linking, process creation, or user approval lifetime.

• Shell clients receive only the launch request endpoint, never loaderd or procd endpoints.
• A selector is resolved only inside an explicitly transferred scope.
• The program scope remains live only while vfsd derives the executable and its .lmf sidecar. Those exact endpoints occupy separate fixed receipt slots; the executable alone is copied to loaderd with SEND, and both aliases must be released through vfsd before TTY installation or start.
• The cwd scope remains live only until the last pre-start boundary. Vfsd then returns one provider-pinned READ_METADATA, job-lifetime directory sender; launchd transfers that sender to procd and retains it only until an authenticated finalization result determines ownership or rollback.
• Explicit standard-stream records already carry exact stream endpoints. Their strings and shell syntax do not trigger filesystem resolution or widen the endpoint's single-stream authority.
• A shared POSIX open description carries separate operation and cleanup-only send endpoints plus one nonzero stream-identity digest. Launchd transfers only operation authority to procd, retains cleanup authority under the job's transaction identity, and accepts only matching OK or idempotent NOT_FOUND release before deleting the local alias. Before commit, the caller remains the semantic cleanup owner: transaction abort deletes launchd's duplicate alias without releasing the provider.
• Ttyd's complete launch-policy reply is correlated to the exact transaction, session, and realm and carries policy evidence only, never capabilities.
• Direct authority requires exact authenticated resolution plus matching session, manifest, script, and invocation ceilings.
• A fully direct request never sets the interactive-approval flag, even when the session's exceptional default is prompt; this keeps routine native commands on the noninteractive fast path.
• Prompting requires explicit invocation, transaction, manifest, and script permission plus ttyd's authenticated exceptional default; promptability itself grants no authority.
• Powerbox BEGIN publishes only a receiver-local numeric reservation. COMMIT is the sole authority-bearing call, uses one exact ENDPOINT SEND scope receipt, and leaves launchd's exact alias available for later canonical requests in the same launch. Finalization consumes it during working-directory resolution; rollback proves it absent before process cleanup, including after a lost or malformed peer reply.
• A process cannot become runnable before every declared child capability is installed, its digest-authenticated argument/environment image is configured, the final TTY session is authenticated, and every temporary authority cleanup obligation is acknowledged.
• Launchd's primary kernel-control endpoint is attenuated to SEND; endpoint creation is available only through a separate exact factory endpoint. The dispatcher retains only each newly created receiver route, publishes only the corresponding attenuated SEND handle, and deletes source aliases before a success reply can complete.
• A job-bound resolver uses its disjoint seventh/eighth route slots. Launchd creates the full source locally, copies only RECV|GRANT into the private vfsd registration call, gives the child exact SEND|GRANT through procd's fixed staging slot, retries rendezvous BUSY until vfsd receives, and advances past an occupied retained destination only on terminal CONFLICT. It persists the exact destination before every potentially ambiguous call. Rollback and terminal cleanup require receipt-free exact unregister (OK or idempotent NOT_FOUND) before the job row can retire.
• A job-bound broker uses the disjoint ninth through eleventh route slots for its temporary full creator, child SEND alias, and retained RECV|GRANT service alias. Immutable manifest object ceilings or observation declarations require the route; its full creator is retired immediately. CPU, clock, and inspection operations are independently gated, and only an explicit successful resource request may return the exact attenuated authority. Successor replacement adopts the new executable's policy on the stable route; terminal cleanup retires both aliases. An ineligible manifest publishes mandatory status without an unused broker pair. The separate twelfth slot retains cwd only for filesystem ceilings, with acknowledged provider release before reuse.
• The stream-pair semantic core partitions caller-sized source/receiver pairs after all twelve-slot job routes and before a nonempty transaction-receipt tail. Version-2 LCH1 authenticates its nonzero entry capacity and the deployment packager patches the matching compiler-derived arena extent. The runtime owns the resulting empty table, an exact narrow factory-effect adapter, and a fair receive-route service. Ordinary and retained-authority finalization invoke the atomic coordinator and install each exact sender through procd. Explicit abort and terminal job cleanup traverse every matching ledger entry; uncertain deletion retains only the exact failed alias for scheduler retry.
• A separate logical-stream table derives its entry count from that same authenticated stream capacity and its disjoint retained-byte extent from the authenticated intent-byte capacity. Reservation reparses the complete committed plan before mutation, copies only selected here-document bodies, and joins pipeline reader/writer roles only on exact session, realm, ingress, stream identity, and kind. Transaction retirement detaches only the owned role, compacts remaining bytes, and zeroes the unused tail. Terminal cleanup first proves every owned endpoint alias absent, closes the logical reader or writer half, and retains the descriptive owner until the caller observes that exact job generation. This lets a sibling transaction committed after a fast child exit attach to a closed half and observe EOF or denial without retaining endpoint authority. Runtime I/O resolves state only after a kernel receive on an exact live endpoint. Failed launches keep the state job-owned while staged or ambiguous child teardown remains pending.
• The provision coordinator is the sole semantic bridge from a committed provisioned-stream plan to endpoint preparation. It exposes prepared rows in stable deterministic ledger order with SEND-only child transfer descriptions. Delivered live rows remain in that ordinal sequence, so a middle pipeline child can install both its reader and writer without the first transfer renumbering the second. A delivered row retires the full- capability source and keeps only launchd's RECV alias. Installation revalidates transaction, complete authenticated scope, stream identity, role, child slot, phase, local capability type, and rights before the transfer. Lost replies retire the source and retain the receiver as an exact rollback obligation; terminal job cleanup retires the receiver and bytes only after child aliases are proven gone.
• A caller-visible job slot is reserved while the child is still staged; no post-start allocation failure can leave a running process without lifecycle ownership.
• CPU-parent links are derived only from authenticated script-route ownership. A CPU snapshot target is selected only by possession of the stable job's narrow accounting sender; caller-supplied numeric job or process identity cannot select another target, and CPU queries transfer no capabilities.
• Partial and malformed transactions remain visible until explicit cleanup.
• Git dependencies use full 40-character commit rev pins. Integration source revisions and CI caches preserve those identities, with no branch-head or synthetic-commit substitution.

Library Boundaries

• lib-ipc owns every numeric operation, discriminant, and wire record.
• lib-capabi owns launchd's exact endpoint provenance, rights, and local slots.
• lib-bootstrap owns service roles and authenticated LCH1 storage geometry.
• lib-sha2 owns canonical SHA-256 computation.
• Runtime code owns real capabilities, syscalls, endpoint I/O, object resolution, loader/procd calls, and capability deletion.

Contact

Development occurs in the EriX organization. Decisions and rationale are recorded in issues and design documents.

Maintainers can be reached at admin@erikinkinen.fi.