[FEATURE] Audit authority, code quality and documentation in launchd #1
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/launchd#1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
This issue tracks continuous Phase 6 audit closure for
launchd. Mediate native launch transactions, authenticated capability receipts, running-job loans and cleanup using caller-supplied state arenas.An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.
Proposed behavior and scope
Staged mediator handoff contract — 15 September 2026
Reserve Loaderd operation
0x654(PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class0x448(REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation0x652keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted.Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop.
Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate.
This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance.
Current inventory: 2 Cargo targets (1 bin, 1 lib); manifests:
Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority.
Authority, security and reliability
Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.
Acceptance criteria
missing_docsenforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.Alternatives and tradeoffs
Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.
Staged mediator source checkpoint — 15 September 2026: Signed Loaderd
adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd64b563482c9ecab115283fe56c8562d948fbbabdand Procdcdb0fe4d1496073521626ce21f0fa2c95a81bd36implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC5fa5fdb2edbfe963efae1c11f99a3a58d0062509and capability ABIe5a3e864491479981b9ab37749109dafe52fa330plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.Native bootstrap destination correction — 15 September 2026
The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI
c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5corrects the constant; Kernelb98156427362a468ae78195a3582901e2474fea5adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.Corrected native staging checkpoint — 15 September 2026: Signed source
e7ad077a1dce4602b116c89bcf2fded07261fac6is recorded in the current review. Select mediator preparation through the transfer-aware loader client and reject substituted operations or incorrect live grant receipts. 326 library/binary tests, strict host/native checks and native binaries pass. CI 129/130 passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing
private Launchd route. The native pending caller must match a retained running
Launchd generation. Its exact 32-byte request carries u32 request ID, opcode,
original process/generation, source and original destination install-grant slots,
then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly
GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native
matching-grant checks establish custody. Previously guarded, started, stale,
ordinary-role and malformed stages refuse before new effects.
Reserve exact rollback ownership first. Use the real returned grant and native
operation 53 to narrow the Created child's primary endpoint to RECV. Establish
an ancestor SEND branch under Kernel lifetime custody and a distinct nested
explicit revoker before any export. Retain the nested sender privately; dispose
the original master, unguarded sender and ancestor-only bypass aliases. The
returned install grant stays exclusively owned for later typed installation.
No new endpoint factory or expanded Process endpoint policy is implied.
The exact 32-byte capability-free reply echoes request/opcode/result/process/
generation, followed by a u32 custody state and two zero words. State 1 occurs
exactly with OK and confirms only guarded unstarted-stage custody; failure state
0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal
cleanup must account for every reused scratch column, actual guard and exact
child identity. Uncertain disposal prevents reuse and ordinary continuation.
Keep ordinary mediator starts denied. Counted final receivers/configuration,
owned fair intake/provider/retirement progress, private execution, authenticated
readiness, initial receiver disposal, seal/publication, real two-realm client I/O
and both complete builds inside EriX remain required. Host models or this guarded
stage acknowledgment cannot substitute for those acceptance gates.
Returned-grant consumer checkpoint — 18 September 2026: Signed revision
41e2dbf8e0c55be2ce09216b31704c7862c59fcdis pushed. The distinct producer moves the sole real grant over the private Procd route. It requires exact correlated acknowledgment and independent source absence before any disposal; deleting a residual source cannot create success evidence. Failed exchanges exhaust local receipt disposal and exact-stage abort. Seven literal transport controls pass with 290 library and 43 runtime units and four native builds. The current adapter remains synchronous and runtime realm orchestration is not yet connected. Formatting and Markdown checks pass. Original CI 133 and CI 134 passes; all four terminal logs are complete (132,090 bytes), without warnings. Matching consumer VM execution, runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall
0x54,RELOCATE_LOCAL_GRANT, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates.Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.
Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained.
Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation.
The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts.
Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete.
Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged.
Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph.
On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant.
Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work.
Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain.
Retained realm caller checkpoint — 18 September 2026: Signed
a084e1167221bacc5dd1b60fec2ae4f05fa39c12is pushed. Replace the obsolete synchronous bootstrap API with a noncopyable native caller and immediate syscall binding. Keep original child, local grant and invocation ownership independent; retain nonzero native IDs on error, release cancellation before ordinary abort and preserve first failures. Require canonical cap-free collection, actual source absence and full invocation retirement. Permanent source absence prevents old cancellation from touching a reused receipt slot. Nineteen focused controls and all six strict default/all and production configurations pass: 302 library and 43 runtime tests, six native builds, formatting, strict host/native Clippy, private-item rustdoc and Markdown without warnings. Original CI 135/136 is under observation. Actual caller-bound runtime admission, deployment-sized owner storage, scheduler integration and real consumer VM execution remain open; this binding alone does not establish runnable realm acceptance.Original retained caller CI acceptance — 18 September 2026: Signed Launchd
a084e1167221bacc5dd1b60fec2ae4f05fa39c12passes CI 135 and CI 136. All four terminal logs are complete (135,122 bytes), with no warnings or failed tests. This closes the original caller CI observation above. Actual runtime admission, scheduler adoption and coordinated consumer VM proof remain required; no complete realm or guest-build acceptance is claimed.Caller-bound realm admission and retained storage contract — 18 September 2026
Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1,
ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs
to filesystem providers and is not reused. Little-endian bodies are exact, with
nonzero request correlation and no fallback to ordinary launch transactions.
BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive
session, authority realm, original process/generation and Running job from the
actual native pending caller. Reserve an independently budgeted realm record,
a nonwrapping generation and one disjoint executable-scope receipt slot before
replying. Client numeric identities or a bearer sender cannot select ownership.
PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record
ID and generation (u64 each), and selector byte length (u64), followed by exactly
that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size
ceiling. The request carries exactly one actual SEND-only directory endpoint to
the reserved receipt slot. Verify the original caller/job/session/authority realm
again and retire every unretained received capability on refusal. Resolve only
inside this explicit directory, authenticate the exact executable and manifest,
and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname,
Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input.
ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID,
operation and complete realm-record ID/generation. They require the same original
Running native owner. READ observes retained state only; ABORT must complete
independent source, invocation and exact-child retirement before its successful
acknowledgment. Parent terminality initiates the same retained cleanup internally.
All four operations have an exact 40-byte capability-free response: request ID,
operation, raw result and state (u32 each), record ID and generation (u64 each),
receipt slot and zero reserved word (u32 each). States are Unconfirmed=0,
Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN
requires Reserved, a nonzero complete handle and receipt slot. PREPARE success
requires Guarded; ABORT success requires Retired. READ returns an authenticated
nonzero state. Only successful BEGIN returns a receipt slot; every other result
has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero
handle while other failures echo the original complete request handle. Unknown
nonzero result codes remain full-width. Unconfirmed proves no resource absence.
Correlate the complete response with the original request before using evidence.
Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the
first 68-byte field order and append realm_capacity (u32 at offset68). Require an
explicit deployment value: zero disables new realm reservations, and nonzero
values allocate that many retained records and disjoint receipt slots. Validate
checked job-route + stream-route + realm-receipt arithmetic before leaving any
ordinary transaction receipt storage. No default or incidental fixed array sets
realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and
Integration policy/packaging; old version/width must reject. Extend the native
capacity descriptor with the realm record's size/alignment and a new layout
version; do not assume ordinary reply records survive long enough for realms.
Keep original child, local scope/grant obligations and native invocation owners
independent. Actual scheduler progress must exclude ordinary and indirect blocking
peer calls while any native invocation needs progress. A permanently discharged
source slot is never revisited after reuse. Native release precedes ordinary
exact-child abort; preserve first errors and exhaust independent cleanup without
returning uncertain state to normal operation. Guarded staging remains private
and unstarted, without exported SEND or a Running job. This initial admission
interface does not define configuration, readiness, sealing or publication.
Coordinated host negatives, strict source-bound build matrices and real consumer
VM execution are required. Two mediator processes, two clients per realm with
actual mediated I/O, complete fair progress, source/effect/frame admission and
both full builds inside EriX remain separate open acceptance requirements.
Caller-bound realm record checkpoint — 18 September 2026: Signed
b85b4d9fa9ccb334055e37630dd2c4889fa52f7cis pushed. Explicit LCH1 version 3 budgets separate noncopyable realm records and disjoint receipt slots; native arena layout version 6 exports their compiler-derived geometry. Semantic reservation, inspection, abort and scope intake authenticate the actual original published Running caller/job/process generation/session/authority realm. Generation never wraps. Independent scope deletion and absence proof retain full signed first errors, and stale cleanup cannot touch a reused slot. One checked slot partition replaces the old overloads and one type-layout definition replaces the duplicated array. Eleven new controls and all six strict configurations pass: 312 library and 44 runtime tests, six native builds, formatting, Clippy, private rustdoc and Markdown without warnings. Original CI 137 and CI 138 pass from four complete logs (137,874 bytes), without warnings. Actual public dispatch, VFS/Loaderd preparation, native progress scheduling, Rootd/Integration startup adoption and consumer VM proof remain required; storage semantics do not establish a runnable realm.Exact realm executable preparation checkpoint — 18 September 2026: Signed
5c58f9e702be3e130b7040be2a042b1a41a5aea8is pushed. Realm preparation now uses actual framed VFS resolution, complete pinned manifest reads and Loaderd PREPARE_REALM. Ordinary TTY launches share the exact-program authenticator while retaining separate policy. The realm record repeats original native caller proof, retains each intermediate obligation and attaches the original bootstrap owner only after authenticated creation. Selector and manifest reuse deployment scratch. Ten new controls and all six strict configurations pass: 322 library and 44 runtime tests, six native builds, formatting, host/native Clippy, private rustdoc and Markdown, without warnings. The ordinary orchestrator is reduced from 944 to 784 lines; new code stays below the physical file ceiling. Original CI is under observation. Public dispatcher, held replies, global scheduling, coordinated startup consumers and source-bound native VM acceptance remain required; host transport controls do not establish a runnable mediator or guest build.Original exact preparation CI acceptance — 18 September 2026: Signed Launchd
5c58f9e702be3e130b7040be2a042b1a41a5aea8passes CI 139 and CI 140. All four terminal logs are complete (140,314 bytes), with no warnings or failed tests. This closes the original caller CI observation above. Actual runtime admission, scheduler adoption and coordinated consumer VM proof remain required; no complete realm or guest-build acceptance is claimed.Public realm dispatch and progress checkpoint — 18 September 2026: Signed
5837873167c5e6ed99045af7052004affb5c28ffis pushed. Public BEGIN, PREPARE, ABORT and READ now dispatch canonical frames and actual receipts through original native caller proof. Held replies survive bounded native progress. Creation/abort reply loss requests cleanup; read or refused-request loss preserves earlier realm ownership. A rotating cursor advances independent retirement before ordinary work and yields while native custody blocks peer calls. Original mediator events match before ordinary job lookup. Eleven new controls and all six strict configurations pass: 322 library and 55 runtime tests, six freestanding builds, formatting, host/native Clippy, private rustdoc and Markdown, without warnings. Process-event handling is split into its own module; all authored code stays below 1,000 lines. Original CI is under observation. Coordinated startup/image consumers and actual consumer VMs remain required, as do configuration, readiness, seal, mediated I/O and both complete builds inside EriX.Original public realm dispatch CI acceptance — 18 September 2026: Signed Launchd
5837873167c5e6ed99045af7052004affb5c28ffpasses CI 141 and CI 142. All four terminal logs are complete (142,951 bytes), with no warnings or failed tests. This closes the original caller CI observation above. Actual runtime consumer adoption and coordinated consumer VM proof remain required; no complete realm or guest-build acceptance is claimed.Coherent startup consumer acceptance — 18 September 2026: Signed Integration
8b1c037aed2503e1f2a4b17c8a8be0666d62a305adopts exact 72-byte LCH1 version 3, explicit realm capacity and version-6 compiler-derived arena geometry across runtime profiles, wire/configuration boundaries and image packaging. Zero realm capacity disables admission while preserving native alignment; realm receipts remain separate from ordinary intake. Both catalogs retain their memberships and select one original 74-source union following 41 coordinated producer updates. The maintained 73-component source-policy gate passes. All 169 helpers and four strict 320/321-unit Rust configurations pass, including formatting, host/native Clippy, native builds and private rustdoc. Both actual consumer VMs pass their unchanged 120-second bounds: Launchd loads from ext4 and reaches ordered readiness; the initial shell prints its banner and exits successfully. Signed appliances, artifact and serial evidence are retained with zero build/VM warnings. Post-VM writable disk identity is recorded separately from the packaging checksum. Original Integration CI is under observation. Full source/effect/frame admission, complete realm operation and both full builds inside EriX remain required.Tracking and rollout
Runtime consumer dependency alignment — 15 September 2026
Signed
7c9d8378eb8bf95bd5a99cf13707881f54c6c0f9aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 326 default / 326 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds:launchd-runtime: 326 development / 326 release tests. There are 6 supported native builds in total. Push/review CI 131/132 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: #2.feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.74b71882d3ea23744dbc50355e654b51e7be4076; refresh component/dependency heads and their own CI evidence as implementation advances.Changed diagnostic observation — 19 September 2026: signed Exsh
e81f0cf0aed0b5a3360d2ee2dac6d3f656c90d3fpasses all eight strict 967-test configurations, native builds, fmt, host/native Clippy and private rustdoc without warnings. Six native frame observations remain incomplete (97/63/100 runtime/all/diagnostic observations). Its bounded failure output uses existing stdout and identifies request 1, BEGIN_REALM, as InvalidReply. The actual telemetry-only VM retains original Launchd5837873167c5e6ed99045af7052004affb5c28ff, the original authority policy, 120-second hard limit and 45-second progress watchdog. It still fails and all 106 artifacts are retained; serial SHA256520999cc511e72ccb0bcb138c107f52ff629e2e3b21aa4d116ff4ad9aa402000(55,858 bytes). No unchanged retry or successful runtime acceptance is claimed.Source review shows that shells receive private script senders, while the initial realm dispatch recognizes these operations only on the public receiver. A Launchd change is under strict validation to enter the shared realm handler after the existing active-envelope and native-owner proof, preserving original held-reply custody and adding no sender. A matching fixed-server VM is required to establish the correction. Integration issue 66 retains both failures. Original Exsh CI 267 and 268 are under observation.
Signed private-route correction — 19 September 2026: Launchd
ca9e7f534e26023a6c011b5cb9a8e256fd56c2d6dispatches realm operations through the shell's existing private script receiver after active-envelope and original native-owner authentication. It repeats Running-job proof in the shared realm handler and preserves the original held reply across both ingress classes. No new sender is delegated. All six strict configurations pass 322 library and 55 runtime tests each, six native builds, fmt, strict host/native Clippy, private rustdoc and Markdown without warnings. Original CI 143 and 144 are under observation. A matching fixed-server VM is still required; Integration issue 66 remains open with both failed predecessor observations.Corrected native caller VM — 19 September 2026: signed Integration
9139c6c5fa38c139e92520f6d410626b4cf1e4aaselects Launchdca9e7f534e26023a6c011b5cb9a8e256fd56c2d6, Exsh9c0f7ab851d527dd9dd10161d6a98e1fdc14598eand Docsce8a1538ab2220f1b346e1a051265f58f83f47fc. The actual VM passes all eleven admission calls over the shell's existing private script route: reservation, reads, full-width stale-generation rejection, missing-scope refusal, acknowledged retirement, record reuse and stale-abort rejection. Exactly oneERIX_EXSH:REALM_ADMISSION:VERIFIEDprecedesERIX_ROOTD:INITIAL_EXSH:EXITED_OK. The original 120-second hard limit and 45-second progress watchdog are unchanged; scenario status is 0 and no build warning is present.All 106 actual appliance artifacts and complete logs are retained. The 55,738-byte serial log has SHA256
bbf41401e975cb0b39c6d62ca32f8e612f4f751a505a7dbb113fe1f05c6415f7; the post-VM writable disk has SHA2568f7faf83e8923de675bf5d030458f7bf7e8065dc4fdb95ec98714dfebc5f7938. The earlier packaging checksum is retained separately. Independent review verifies all 73 original component revisions, the packaged diagnostic executable and the signed image's exact 72-byte LCH1 version-3 capacity record (four realm records; native arena 102,400 bytes). All 169 helper commands, twelve route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. Both failed predecessor images remain evidence in issue 66.The first BEGIN failed because the shell's private script intake lacked realm dispatch. The correction retains active-envelope and original native-owner checks and original reply custody, without delegating a new sender. Exsh's uncertain-disposal path makes no stdout IPC before terminal failure. Original Integration CI 1675 and 1676 are queued. Successful preparation, mediator configuration/readiness/sealing, client byte I/O, complete source/effect/frame proof, native Rust/LLVM rebuilding and both full EriX builds remain required. This partial lifecycle acceptance adds no whole checklist item.
Next native validation — 19 September 2026: add an opt-in Exsh guarded-preparation diagnostic using the existing realm ABI. Keep the passing eleven-call admission-only scenario separate. The new diagnostic will reserve a record, transfer exactly one SEND-only copy of its explicitly supplied startup cwd to the BEGIN-reserved receipt slot, select
bin/truewithin that initial root scope, require PREPARE/Guarded and READ/Guarded, then require ABORT/Retired and a stale READ/NOT_FOUND. The packaged nativetrueexecutable is an unstarted staging fixture; it does not stand in for a running POSIX mediator.The existing authenticated private Launchd route remains the sole request path. No ordinary start, new endpoint, root capability or implicit namespace is introduced. Launchd must retire its received directory copy after exact resolution; Loaderd must return the original staged child and grant, and Procd must retain the actual returned grant and guarded sender branch before acknowledging Guarded. Abort must retire that exact stage and retained custody. Error telemetry must preserve application refusal codes and stop ordinary output after uncertain receipt disposal. Independent host controls will cover literal operation order, transfer scope/rights, full correlation, missing or malformed acknowledgments, surplus receipts and no continuation after failure. The new actual VM retains the 120-second hard and 45-second progress limits and requires its own unique marker before ordinary shell exit. Full source/effect/frame proof, configured/sealed mediator execution, real client byte I/O, native Rust/LLVM rebuilding and both full EriX builds remain required.
Original CI update — 19 September 2026: Launchd run 143 passes with complete retained logs. Run 144, for the same signed
ca9e7f534e26023a6c011b5cb9a8e256fd56c2d6source, fails its Markdown job while its Rust job passes. The complete 67,910-byte Rust log is retained without warnings. Two spaced GET observations of the failed Markdown job log return HTTP 500; that log is unavailable and the failure cause is unclassified. The workflow has not been rerun or cancelled, and the paired passing run does not replace this failure. The separately retained corrected caller VM passes; full original CI acceptance remains open.Native guarded preparation — 19 September 2026: signed Integration
78557a6c672ecf426dfe894a01cc4aeec73b5e3cselects signed Exshffe50612889dd58a45a40d04593a4aa3a3ffa512for the separateappliance-disk-image-realm-preparation-positivescenario. The actual VM passes the eleven existing admission calls followed by BEGIN/Reserved, PREPARE/Guarded, READ/Guarded, ABORT/Retired and stale READ/NOT_FOUND. It transfers exactly one SEND-only copy of the explicitly supplied initial cwd to the authenticated reservation and selectsbin/trueinside that scope. This packaged executable remains an unstarted staging fixture. The existing private Launchd route is reused; no new endpoint, root grant or implicit namespace is introduced.Exactly one admission marker and one
ERIX_EXSH:REALM_PREPARATION:VERIFIEDprecede ordinary successful initial-shell exit. The original 120-second hard deadline and 45-second progress watchdog remain unchanged; scenario status is zero and build warnings are absent. The separate admission-only scenario is preserved. All 106 actual appliance artifacts and complete logs are retained. Serial SHA256 is7ef35833c2d88abcd093c8813791e11cea0d34edb2e29b8686df6996e2bc32ff(55,776 bytes); post-VM writable disk SHA256 is3439d0750ea456ceb8d9fbb063d6af763b4198a85f0270ae8d22c76c6ff99499. Its earlier packaging checksum is retained separately. Independent artifact review verifies all 73 original component revisions, both diagnostic markers in the actual packaged executable, and the signed image's exact 72-byte LCH1 version-3 configuration with four realm records and a 102,400-byte native arena.All 169 Integration helper commands, seventeen route/scenario controls and four strict 320/321-test Rust configurations pass, including native builds, fmt, strict host/native Clippy and private rustdoc; all 394 host streams are warning-free. The post-validation source delta changes only the two Exsh catalog pins and final documentation status, preserving checked implementation bytes. Exsh passes ten strict 976-test configurations, ten native builds and 355 frame-checker controls without warnings. Eight actual frame observations retain complete workspace mapping but incomplete 97/63/100/100 runtime/all/admission/preparation proof in both policies; the full frame gate remains required.
Original Integration CI 1677 and 1678 are queued. Original Exsh CI 271 and 272 are under observation. Complete typed mediator bootstrap, readiness/configuration/sealing, real client byte I/O, complete source/effect/frame proof, native upstream Rust/LLVM rebuilding and both full EriX build generations remain required. This prerequisite adds no accepted whole checklist item.
Minimum bootstrap design — 19 September 2026: signed Posixd proposal, in PR 5, specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate.
Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution.
The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original Posixd CI 19 and 20 pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added.
Native child-lifetime prerequisite — 19 September 2026: Kernel design #19 now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration
a62d1381f56a01afc692112d9b427205eaeb6a2e. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.Verified grant-rights checkpoint — 20 September 2026:
Signed commit be2e28730f714b35e356e925cee8061c67e0799d requires exact GRANT-only final installer receipts and selects the original shared dependency graph. Four strict 377-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting and private rustdoc pass without warnings. Original CI 145/146 passes from four complete hashed logs (142,882 bytes), with zero warning candidates.
Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256
6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.Full coordinated consumer acceptance remains open under Kernel design 19 and phase completion.
Acknowledged terminal service dependencies — 21 September 2026: signed f5400949ec4e86055ea00e574ebe89f8f098f571 selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under Kernel design 20. All 4 strict 377-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI 147, 148 passes; complete hashed logs total 142,968 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in Phase 6 completion.
[FEATURE] [P02.R27] Audit authority, code quality and documentation in launchdto [FEATURE] Audit authority, code quality and documentation in launchd