erix/lib-bootstrap

Watch

Fork 0

generated from erix/meta

[FEATURE] Audit authority, code quality and documentation in lib-bootstrap #1

New issue

Open

opened 2026-09-12 07:57:41 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:57:41 +02:00

Owner

Problem and motivation

This issue tracks continuous Phase 6 audit closure for lib-bootstrap. Define and validate bootstrap byte contracts, role startup records and payloads shared by rootd and launched services.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Current inventory: 1 Cargo target (1 lib); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Trace authority-bearing values across callers and public APIs; prove that the library does not acquire hidden service, hardware or host authority. Treat startup/teardown and rootd parity dimensions as caller/consumer contracts where this crate owns no process, with a separate evidence-backed applicability decision per row.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Process-bound installation checkpoint — 15 September 2026: Signed dad8efbc5c73e2fa5999a417cd3a70cda26e4100 aligns the original shared IPC/capability dependencies for process-bound native consumers. Existing helper code and authority ceilings remain unchanged relative to its preceding feature checkpoint. Default/all-feature development/release tests, strict host and freestanding Clippy, native builds, private rustdoc, formatting and Markdown pass. The observed push CI run is successful; complete log classification and a review-triggered run remain required. No new realm behavior or guest build is claimed.

Process-bound native acceptance — 15 September 2026: The signed helper checkpoint now passes both push and review CIs with complete warning-free logs. Procd consumes the coherent original dependency graph and passes its full host/native matrix. Component acceptance does not close complete realm or guest-build work. Review: #2.

Staged mediator source checkpoint — 15 September 2026: Signed Loaderd adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd 64b563482c9ecab115283fe56c8562d948fbbabd and Procd cdb0fe4d1496073521626ce21f0fa2c95a81bd36 implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC 5fa5fdb2edbfe963efae1c11f99a3a58d0062509 and capability ABI e5a3e864491479981b9ab37749109dafe52fa330 plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.

Corrected native staging checkpoint — 15 September 2026: Signed source 2abce4be1df84ce7d5eb1c112cb5ac0fa038e471 is recorded in the current review. Align the original signed dependency graph for staged mediator producers while preserving helper behavior and authority ceilings. 78 tests pass in the full default/all development/release matrix, with strict host/native Clippy, native builds, private rustdoc and formatting. Matching push/review CI passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Native terminal generation checkpoint — 17 September 2026: Signed revision 6c00a68d95e45c0bef7d994901d07754cf33e3f4 is pushed. The coherent immutable dependency graph now selects the generation-bearing operation 55 contract. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, freestanding builds, rustdoc, formatting and Markdown checks pass. Native producer/consumer migration, matching VM execution and full guest builds remain separate acceptance gates. Original automatic CI is being collected without retries.

Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision d193a3af986b25ca343df7eb647ca4731aac2d0b is pushed. The coherent immutable dependency graph adopts the checked generation-bound cleanup ABI. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and rustdoc pass. Formatting and Markdown checks pass. Original CI 141 and CI 142 passes; all four terminal logs are complete (65,538 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Returned-grant shared contract checkpoint — 18 September 2026: Signed revision 5d18cece2f79fc47525ede8082b28327ae08a066 is pushed. The coherent immutable dependency graph adopts the checked returned-grant bootstrap contract. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original CI 143 and CI 144 passes; all four terminal logs are complete (65,538 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Caller-local grant relocation checkpoint — 18 September 2026: Signed revision 7e85d209e3594794a6d555823e6f04b3ec5590a1 is pushed. The coherent immutable dependency graph adopts the caller-local grant relocation ABI. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original CI 145 and CI 146 passes; all four terminal logs are complete (65,506 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Explicit receiver admission checkpoint — 18 September 2026: Signed revision e271f23d0bd367806d749ad1b3011f7ee48dd70c is pushed. The coherent immutable dependency graph adopts explicit owned receiver request budgets. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original CI 147 and CI 148 passes; all four terminal logs are complete (65,476 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Owned bootstrap wire checkpoint — 18 September 2026: Signed revision 07d009dd6af40155f001592fb5a3ca5d1eae10d3 is pushed. The coherent immutable dependency graph adopts the identity-only owned bootstrap request. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original CI 149 and CI 150 passes; all four terminal logs are complete (65,482 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Original supervisor wire checkpoint — 18 September 2026: Signed revision de9f676aeb4631fb7fb1a732134cd4e9345366ba is pushed. The coherent immutable dependency graph adopts the supervisor-aware materialization request. Local runtime policy is unchanged. Default/all development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original CI 151 and CI 152 passes; all four terminal logs are complete (65,502 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.

Caller-bound realm admission and retained storage contract — 18 September 2026

Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1,
ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs
to filesystem providers and is not reused. Little-endian bodies are exact, with
nonzero request correlation and no fallback to ordinary launch transactions.

BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive
session, authority realm, original process/generation and Running job from the
actual native pending caller. Reserve an independently budgeted realm record,
a nonwrapping generation and one disjoint executable-scope receipt slot before
replying. Client numeric identities or a bearer sender cannot select ownership.

PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record
ID and generation (u64 each), and selector byte length (u64), followed by exactly
that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size
ceiling. The request carries exactly one actual SEND-only directory endpoint to
the reserved receipt slot. Verify the original caller/job/session/authority realm
again and retire every unretained received capability on refusal. Resolve only
inside this explicit directory, authenticate the exact executable and manifest,
and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname,
Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input.

ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID,
operation and complete realm-record ID/generation. They require the same original
Running native owner. READ observes retained state only; ABORT must complete
independent source, invocation and exact-child retirement before its successful
acknowledgment. Parent terminality initiates the same retained cleanup internally.

All four operations have an exact 40-byte capability-free response: request ID,
operation, raw result and state (u32 each), record ID and generation (u64 each),
receipt slot and zero reserved word (u32 each). States are Unconfirmed=0,
Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN
requires Reserved, a nonzero complete handle and receipt slot. PREPARE success
requires Guarded; ABORT success requires Retired. READ returns an authenticated
nonzero state. Only successful BEGIN returns a receipt slot; every other result
has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero
handle while other failures echo the original complete request handle. Unknown
nonzero result codes remain full-width. Unconfirmed proves no resource absence.
Correlate the complete response with the original request before using evidence.

Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the
first 68-byte field order and append realm_capacity (u32 at offset68). Require an
explicit deployment value: zero disables new realm reservations, and nonzero
values allocate that many retained records and disjoint receipt slots. Validate
checked job-route + stream-route + realm-receipt arithmetic before leaving any
ordinary transaction receipt storage. No default or incidental fixed array sets
realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and
Integration policy/packaging; old version/width must reject. Extend the native
capacity descriptor with the realm record's size/alignment and a new layout
version; do not assume ordinary reply records survive long enough for realms.

Keep original child, local scope/grant obligations and native invocation owners
independent. Actual scheduler progress must exclude ordinary and indirect blocking
peer calls while any native invocation needs progress. A permanently discharged
source slot is never revisited after reuse. Native release precedes ordinary
exact-child abort; preserve first errors and exhaust independent cleanup without
returning uncertain state to normal operation. Guarded staging remains private
and unstarted, without exported SEND or a Running job. This initial admission
interface does not define configuration, readiness, sealing or publication.

Coordinated host negatives, strict source-bound build matrices and real consumer
VM execution are required. Two mediator processes, two clients per realm with
actual mediated I/O, complete fair progress, source/effect/frame admission and
both full builds inside EriX remain separate open acceptance requirements.

Caller-bound realm storage wire checkpoint — 18 September 2026: Signed revision 6799ecf6cacabaa3d6adc3807ac43224e07d08f1 is pushed. Exact 72-byte LCH1 version 3 replaces the obsolete version-2 codec. Explicit realm capacity includes zero to disable reservations. Checked job/stream/realm slot arithmetic preserves ordinary intake. Two new malformed/overflow controls and all four strict 80-test configurations pass. Coordinated Rootd and Integration adoption remains required before image acceptance. Formatting and Markdown checks pass. Original CI 153 and CI 154 passes; all four terminal logs are complete (66,024 bytes), without warnings. Actual admission dispatch, coordinated consumer VMs, runnable mediators and both full builds inside EriX remain separate open acceptance requirements.

Tracking and rollout

Runtime dependency alignment — 15 September 2026

Signed 03fe59dca975b6caca0643304b7f71f9ae989bde aligns the existing dependency pins with the original signed library graph. This checkpoint changes Cargo selections and the roadmap; the repository's Rust implementation files are unchanged. The default/all-feature development/release matrix passes 78 tests in each feature/profile configuration, formatting, strict host/native Clippy, 4 native builds and private rustdoc, without warnings. Canonical documentation checks pass. Push/review CI 137/138 passes with complete classified logs and no warnings. Coherent product catalog adoption and product VM acceptance remain pending. Review: #2.

Validated mediator constructor adoption — 15 September 2026

Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place.

Signed original revision f4239deee4ac9ba96aaa49891d686275782e63d9. All 78 tests and the full strict default/all development/release host/native matrix pass. Exact push/review CI has complete warning-free logs. The existing shared graph follows signed IPC 7c771205 and applicable capability ABI 2d6b1283 through original Git objects; no dependency or helper authority is added. Repeated roadmap notes are consolidated.

The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs 8b30523f3d7e1c300f39e3418a8748dae10ec04f; all 45 tests, final warning-free rendering and CI 877/878 pass.

Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete.

Parent work: erix/integration#2 and erix/docs#1.
Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
Baseline revision: fc8c68556c9f347b1bf08232a27050875bce0bbb; refresh component/dependency heads and their own CI evidence as implementation advances.
Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

Explicit install-grant library checkpoint — 19 September 2026: signed/pushed commit d3783662dc893fe2b0453d2bef0ff79c24aba96b. Original dependency pins now select the shared explicit grant-rights contract without mixed wire/capability revisions. The local API and authority policy are unchanged. Four host test matrices pass 80 tests each, alongside four native builds, strict host/native Clippy, formatting, private rustdoc and policy checks. Validation has no warnings. Original CI 155/156 passes with four complete hashed logs (66,000 bytes), zero warnings.

Coordinated actual consumers and matching native execution remain open under Kernel design 19. This dependency/wire checkpoint does not establish complete lifecycle acceptance or either full EriX build generation. Phase completion retains native external Rust/LLVM/runtime rebuilding as an independent requirement.

Acknowledged terminal consumer dependencies — 21 September 2026: signed commit 8110627a67238183b65873dc9d25b4bf51fdd8a7 aligns original shared revisions for repeatable terminal observation and exact acknowledgement under Kernel design 20. No local API or capability policy changes. Four strict 80-unit host configurations, four native builds, host/native Clippy, private rustdoc, formatting and dependency checks pass without warnings. Original CI 157, 158 passes; four complete logs total 66,030 bytes with verified hashes and zero warning candidates. Actual service consumer and coherent full VM adoption remain open in phase completion.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `lib-bootstrap`. Define and validate bootstrap byte contracts, role startup records and payloads shared by rootd and launched services. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope Current inventory: 1 Cargo target (1 lib); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Trace authority-bearing values across callers and public APIs; prove that the library does not acquire hidden service, hardware or host authority. Treat startup/teardown and rootd parity dimensions as caller/consumer contracts where this crate owns no process, with a separate evidence-backed applicability decision per row. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Process-bound installation checkpoint — 15 September 2026: Signed `dad8efbc5c73e2fa5999a417cd3a70cda26e4100` aligns the original shared IPC/capability dependencies for process-bound native consumers. Existing helper code and authority ceilings remain unchanged relative to its preceding feature checkpoint. Default/all-feature development/release tests, strict host and freestanding Clippy, native builds, private rustdoc, formatting and Markdown pass. The observed push CI run is successful; complete log classification and a review-triggered run remain required. No new realm behavior or guest build is claimed. Process-bound native acceptance — 15 September 2026: The signed helper checkpoint now passes both push and review CIs with complete warning-free logs. Procd consumes the coherent original dependency graph and passes its full host/native matrix. Component acceptance does not close complete realm or guest-build work. Review: https://git.erikinkinen.fi/erix/lib-bootstrap/pulls/2. Staged mediator source checkpoint — 15 September 2026: Signed Loaderd `adefd028c47d0e60bde65ef2ff2d95c8bfae11b6`, Launchd `64b563482c9ecab115283fe56c8562d948fbbabd` and Procd `cdb0fe4d1496073521626ce21f0fa2c95a81bd36` implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC `5fa5fdb2edbfe963efae1c11f99a3a58d0062509` and capability ABI `e5a3e864491479981b9ab37749109dafe52fa330` plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately. Corrected native staging checkpoint — 15 September 2026: Signed source `2abce4be1df84ce7d5eb1c112cb5ac0fa038e471` is recorded in [the current review](https://git.erikinkinen.fi/erix/lib-bootstrap/pulls/2). Align the original signed dependency graph for staged mediator producers while preserving helper behavior and authority ceilings. 78 tests pass in the full default/all development/release matrix, with strict host/native Clippy, native builds, private rustdoc and formatting. Matching push/review CI passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Native terminal generation checkpoint — 17 September 2026: Signed revision `6c00a68d95e45c0bef7d994901d07754cf33e3f4` is pushed. The coherent immutable dependency graph now selects the generation-bearing operation 55 contract. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, freestanding builds, rustdoc, formatting and Markdown checks pass. Native producer/consumer migration, matching VM execution and full guest builds remain separate acceptance gates. Original automatic CI is being collected without retries. Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision `d193a3af986b25ca343df7eb647ca4731aac2d0b` is pushed. The coherent immutable dependency graph adopts the checked generation-bound cleanup ABI. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and rustdoc pass. Formatting and Markdown checks pass. Original [CI 141](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/141) and [CI 142](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/142) passes; all four terminal logs are complete (65,538 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Returned-grant shared contract checkpoint — 18 September 2026: Signed revision `5d18cece2f79fc47525ede8082b28327ae08a066` is pushed. The coherent immutable dependency graph adopts the checked returned-grant bootstrap contract. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original [CI 143](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/143) and [CI 144](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/144) passes; all four terminal logs are complete (65,538 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Caller-local grant relocation checkpoint — 18 September 2026: Signed revision `7e85d209e3594794a6d555823e6f04b3ec5590a1` is pushed. The coherent immutable dependency graph adopts the caller-local grant relocation ABI. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original [CI 145](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/145) and [CI 146](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/146) passes; all four terminal logs are complete (65,506 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Explicit receiver admission checkpoint — 18 September 2026: Signed revision `e271f23d0bd367806d749ad1b3011f7ee48dd70c` is pushed. The coherent immutable dependency graph adopts explicit owned receiver request budgets. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original [CI 147](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/147) and [CI 148](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/148) passes; all four terminal logs are complete (65,476 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Owned bootstrap wire checkpoint — 18 September 2026: Signed revision `07d009dd6af40155f001592fb5a3ca5d1eae10d3` is pushed. The coherent immutable dependency graph adopts the identity-only owned bootstrap request. Local runtime policy is unchanged. Default/all-feature development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original [CI 149](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/149) and [CI 150](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/150) passes; all four terminal logs are complete (65,482 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Original supervisor wire checkpoint — 18 September 2026: Signed revision `de9f676aeb4631fb7fb1a732134cd4e9345366ba` is pushed. The coherent immutable dependency graph adopts the supervisor-aware materialization request. Local runtime policy is unchanged. Default/all development and release units, strict host/native Clippy, native builds and private-item rustdoc pass. Formatting and Markdown checks pass. Original [CI 151](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/151) and [CI 152](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/152) passes; all four terminal logs are complete (65,502 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements. Caller-bound realm admission and retained storage contract — 18 September 2026 Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1, ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs to filesystem providers and is not reused. Little-endian bodies are exact, with nonzero request correlation and no fallback to ordinary launch transactions. BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive session, authority realm, original process/generation and Running job from the actual native pending caller. Reserve an independently budgeted realm record, a nonwrapping generation and one disjoint executable-scope receipt slot before replying. Client numeric identities or a bearer sender cannot select ownership. PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record ID and generation (u64 each), and selector byte length (u64), followed by exactly that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size ceiling. The request carries exactly one actual SEND-only directory endpoint to the reserved receipt slot. Verify the original caller/job/session/authority realm again and retire every unretained received capability on refusal. Resolve only inside this explicit directory, authenticate the exact executable and manifest, and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname, Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input. ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID, operation and complete realm-record ID/generation. They require the same original Running native owner. READ observes retained state only; ABORT must complete independent source, invocation and exact-child retirement before its successful acknowledgment. Parent terminality initiates the same retained cleanup internally. All four operations have an exact 40-byte capability-free response: request ID, operation, raw result and state (u32 each), record ID and generation (u64 each), receipt slot and zero reserved word (u32 each). States are Unconfirmed=0, Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN requires Reserved, a nonzero complete handle and receipt slot. PREPARE success requires Guarded; ABORT success requires Retired. READ returns an authenticated nonzero state. Only successful BEGIN returns a receipt slot; every other result has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero handle while other failures echo the original complete request handle. Unknown nonzero result codes remain full-width. Unconfirmed proves no resource absence. Correlate the complete response with the original request before using evidence. Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the first 68-byte field order and append realm_capacity (u32 at offset68). Require an explicit deployment value: zero disables new realm reservations, and nonzero values allocate that many retained records and disjoint receipt slots. Validate checked job-route + stream-route + realm-receipt arithmetic before leaving any ordinary transaction receipt storage. No default or incidental fixed array sets realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and Integration policy/packaging; old version/width must reject. Extend the native capacity descriptor with the realm record's size/alignment and a new layout version; do not assume ordinary reply records survive long enough for realms. Keep original child, local scope/grant obligations and native invocation owners independent. Actual scheduler progress must exclude ordinary and indirect blocking peer calls while any native invocation needs progress. A permanently discharged source slot is never revisited after reuse. Native release precedes ordinary exact-child abort; preserve first errors and exhaust independent cleanup without returning uncertain state to normal operation. Guarded staging remains private and unstarted, without exported SEND or a Running job. This initial admission interface does not define configuration, readiness, sealing or publication. Coordinated host negatives, strict source-bound build matrices and real consumer VM execution are required. Two mediator processes, two clients per realm with actual mediated I/O, complete fair progress, source/effect/frame admission and both full builds inside EriX remain separate open acceptance requirements. Caller-bound realm storage wire checkpoint — 18 September 2026: Signed revision `6799ecf6cacabaa3d6adc3807ac43224e07d08f1` is pushed. Exact 72-byte LCH1 version 3 replaces the obsolete version-2 codec. Explicit realm capacity includes zero to disable reservations. Checked job/stream/realm slot arithmetic preserves ordinary intake. Two new malformed/overflow controls and all four strict 80-test configurations pass. Coordinated Rootd and Integration adoption remains required before image acceptance. Formatting and Markdown checks pass. Original [CI 153](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/153) and [CI 154](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/154) passes; all four terminal logs are complete (66,024 bytes), without warnings. Actual admission dispatch, coordinated consumer VMs, runnable mediators and both full builds inside EriX remain separate open acceptance requirements. ## Tracking and rollout ### Runtime dependency alignment — 15 September 2026 Signed `03fe59dca975b6caca0643304b7f71f9ae989bde` aligns the existing dependency pins with the original signed library graph. This checkpoint changes Cargo selections and the roadmap; the repository's Rust implementation files are unchanged. The default/all-feature development/release matrix passes 78 tests in each feature/profile configuration, formatting, strict host/native Clippy, 4 native builds and private rustdoc, without warnings. Canonical documentation checks pass. Push/review CI 137/138 passes with complete classified logs and no warnings. Coherent product catalog adoption and product VM acceptance remain pending. Review: https://git.erikinkinen.fi/erix/lib-bootstrap/pulls/2. ### Validated mediator constructor adoption — 15 September 2026 Procd selects checked native operation 54 only for mediator staging, without a parent VSpace receipt. The native TCB retains backing; the child initially holds only its primary endpoint. Other roles retain ordinary construction and its existing receipt/drop sequence. A refusal never falls back to operation 32. Scratch absence cleanup, exact stage retirement, private endpoint-master custody, grant-only handoff and all ordinary mediator start gates remain in place. Signed original revision `f4239deee4ac9ba96aaa49891d686275782e63d9`. All 78 tests and the full strict default/all development/release host/native matrix pass. Exact push/review CI has complete warning-free logs. The existing shared graph follows signed IPC 7c771205 and applicable capability ABI 2d6b1283 through original Git objects; no dependency or helper authority is added. Repeated roadmap notes are consolidated. The previously accepted Kernel 6d2ca19c native fixture establishes the constructor object, root-absence and backing contract. This checkpoint adds producer transport controls; it does not claim a new Procd CPL3 VM, runtime-image adoption or runnable realm. Integration source and native VM inputs are unchanged. The manual is signed at Docs `8b30523f3d7e1c300f39e3418a8748dae10ec04f`; all 45 tests, final warning-free rendering and CI 877/878 pass. Runtime-image adoption, authenticated grant return, guarded bootstrap routes, private execution, receiver readiness, configuration/seal, client I/O, fair retirement and both full guest build generations remain open. Whole-codebase semantic authority and private-item documentation audits remain incomplete. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `fc8c68556c9f347b1bf08232a27050875bce0bbb`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images. Explicit install-grant library checkpoint — 19 September 2026: signed/pushed commit [d3783662dc893fe2b0453d2bef0ff79c24aba96b](https://git.erikinkinen.fi/erix/lib-bootstrap/commit/d3783662dc893fe2b0453d2bef0ff79c24aba96b). Original dependency pins now select the shared explicit grant-rights contract without mixed wire/capability revisions. The local API and authority policy are unchanged. Four host test matrices pass 80 tests each, alongside four native builds, strict host/native Clippy, formatting, private rustdoc and policy checks. Validation has no warnings. Original CI 155/156 passes with four complete hashed logs (66,000 bytes), zero warnings. Coordinated actual consumers and matching native execution remain open under [Kernel design 19](https://git.erikinkinen.fi/erix/kernel/issues/19). This dependency/wire checkpoint does not establish complete lifecycle acceptance or either full EriX build generation. [Phase completion](https://git.erikinkinen.fi/erix/integration/issues/65) retains native external Rust/LLVM/runtime rebuilding as an independent requirement. Acknowledged terminal consumer dependencies — 21 September 2026: signed commit [8110627a67238183b65873dc9d25b4bf51fdd8a7](https://git.erikinkinen.fi/erix/lib-bootstrap/commit/8110627a67238183b65873dc9d25b4bf51fdd8a7) aligns original shared revisions for repeatable terminal observation and exact acknowledgement under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). No local API or capability policy changes. Four strict 80-unit host configurations, four native builds, host/native Clippy, private rustdoc, formatting and dependency checks pass without warnings. Original CI [157](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/157), [158](https://git.erikinkinen.fi/erix/lib-bootstrap/actions/runs/158) passes; four complete logs total 66,030 bytes with verified hashes and zero warning candidates. Actual service consumer and coherent full VM adoption remain open in [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65).

erikinkinen added the

labels

2026-09-12 07:57:41 +02:00

erikinkinen referenced this issue from erix/integration

2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from ~~[FEATURE] [P02.R31] Audit authority, code quality and documentation in lib-bootstrap~~ to [FEATURE] Audit authority, code quality and documentation in lib-bootstrap

2026-09-12 08:02:23 +02:00

erikinkinen referenced this issue

2026-09-15 10:04:45 +02:00

WIP: Align native mediator construction dependencies #2

erikinkinen referenced this issue

2026-09-17 23:45:56 +02:00

[BUG] Original Markdown CI job fails with an unavailable terminal log #3

erikinkinen referenced this issue from erix/integration

2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65

erikinkinen referenced this issue from erix/integration

2026-09-19 23:04:19 +02:00