lib-ipc

lib-ipc owns the shared, architecture-independent IPC wire contracts used by EriX kernels, services, drivers, and libraries. The repository also contains the ipc-syscall-x86_64 crate, which is the narrow userspace boundary for the x86-64 syscall register ABI.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

See:

• docs for system architecture and the technical manual
• kernel for transport enforcement
• lib-capabi for authority-transfer policy

Purpose of This Repository

Launch record 11 describes one inherited dynamic-stream loan with only an exact SEND operation receipt. It carries no cleanup authority. Launchd binds the loan to the authenticated live lender job and creates a child-close-local proxy; the canonical child startup description layout remains unchanged.

Post-start job authority contracts carry exact operation, lifetime, selector, grant generation, and receipt-destination evidence. Acquire returns one SEND-only endpoint; release is receipt-free. Powerbox's one-shot export keeps its revoker while transferring only a derived alias. The x86-64 local-alias syscall uses existing caller-owned SEND authority and empty local slots, with no kernel-control endpoint or target-process selector.

The read-only pending_reply_caller_identity syscall (0x4A) authenticates the actual live process and generation behind an already-delivered CALL. Only its recorded receiver with local RECV authority may query it. Forwarded SEND aliases cannot impersonate their original holder; brokers compare the returned identity to their retained job and recheck after blocking effects.

Manifest flags declare broker operations and optional cwd, resolver, inspection, and inherited-launch routes. They do not authorize parsing utility arguments in the launcher or eagerly installing mutation and clock capabilities.

This repository provides the common vocabulary at IPC trust boundaries. It defines operation identifiers, fixed-width message and body layouts, little-endian encoders, fail-closed parsers, and checked table/range helpers. It does not route messages, discover services, allocate transport storage, or decide which caller may hold an endpoint.

The maintained responsibilities are:

• define the 40-byte IpcMessageHeaderV1 envelope and typed body contracts
• validate versions, reserved fields, body sizes, ranges, padding, and known discriminants where the individual contract requires them
• define the 16-byte capability-transfer descriptor containing only source slot, destination slot, capability type, and delegated rights
• preserve kernel-authenticated transfer receipts on delivery so receivers can account for and revoke every installed alias
• compare parsed receipt sequences against caller-provided exact plans covering source provenance, destination, capability type, rights, order, and absence of surplus authority without allocating or acting on the capabilities
• provide one allocation-free call parser that retires every unexpected received alias and distinguishes complete rejection from uncertain cleanup
• expose service, driver, kernel-control, loader, and dynamic-link operation identifiers without embedding project-planning terminology or a redundant second body-type namespace
• distinguish public serial output-history reads from authenticated tty-session UART-input dequeue while reusing one authority-free bounded stream shape
• define private trusted serial writes on that same authenticated tty route; trusted review bytes bypass public history, ordinary writers are backpressured during review, and an empty zero-padded write explicitly releases arbitration
• encode job-bound cwd changes with one exact held-scope receipt and one exact returned sender; immutable delegated ceiling and logical/physical paths are descriptive response evidence, not caller-selected authority
• provide a wire-identical borrowed VFS write encoder so services need not place a maximum-size I/O payload on a bounded userspace stack
• define no-follow immediate-child metadata requests selected by an explicit directory metadata endpoint, with a separate private provider handle body;
• admit read-only object metadata as an explicitly selected bootstrap session ceiling for long listings, without automatically granting it to any command;
• define private no-follow cwd component opens and pinned-link reads, with independently closable handles and opaque identities valid only while held; neither form permits a parent path or confers enumeration/content authority
• define a root-only boot-module-retirement endpoint kind and canonical no-input one-shot request, so callers cannot select an address, range, or module identity
• define early kernel logging as a destructive, single-consumer record transfer so the kernel retains neither copied storage nor replay-cursor authority
• expose log retention and sink-delivery status with explicit capacity, occupancy, pending-delivery, and dropped-delivery counters
• expose x86-64 syscall wrappers whose arguments map directly to the documented register ABI
• expose retained call/reply helpers that keep caller-owned buffers live through asynchronous completion without discovering endpoints or imposing local retry ceilings; any changed declared request must decode as one complete reply
• distinguish retryable rendezvous BUSY from terminal explicit-destination CONFLICT, so callers can change only the destination that prevented progress
• define allocation-free ordered-stream bodies with explicit offsets, partial progress, receiver-sized reads, backpressure results, EOF, half-close, cancellation, peer failure, and observable cleanup state
• define PTY mode, resize, lifecycle, ordinary-control, and structurally distinct trusted-control bodies so trusted events cannot be decoded as text or ordinary PTY events
• define one authority-free versioned signal catalog with stable identities, names, default-action classes, pristine dispositions, and immutable-signal policy; inherited ignores remain distinct from signal-specific default ignore
• define one compact inherited-disposition bit set that admits only catalog signals and cannot encode ignored KILL or STOP, plus a tagged signal-derived process termination reason and exact POSIX shell status
• define receipt-free signal-delivery bodies for the existing exact job-control route and launchd-private exact process/generation route; cancellation remains a distinct operation, canonical termination carries the already-captured terminal CPU snapshot, failures expose no outcome or time, and stop/continue outcomes remain unrepresentable until real kernel transitions exist
• define a receipt-free identity read on the same exact job-control route so a monitor can reconcile that capability with descriptive session-process data; the reply returns no handle and its numeric identity cannot select a target
• define read-only processor topology/counter and allocator-total snapshots, plus cursor-based process records whose launchd receiver—not a numeric PID or session field—selects the visible session; inspection bodies transfer no capability and remain distinct from existing job-control messages
• require exact receipt-free ordinary PTY event shapes: nonzero request correlation, consecutive cursors, event-specific signal/value fields, and a zero-valued same-cursor RETRY
• define receipt-free foreground-event continuations from launchd to procd by exact process generation and from an exact job status route to its requester; failures preserve the caller cursor and return no event data or capability
• define a terminal-only status-and-CPU-time read on that same exact job status route; a pending child returns zero-shaped RETRY, while successful delivery consumes the job observation without exposing a PID, session, or job number
• define an authority-free session-context query whose request contains only correlation and whose successful response returns nonzero session and realm data selected by the already session-bound lifecycle endpoint
• authenticate an inherited-script-launch manifest requirement that can install only a nested route copied from the invoking parent script ceiling; the flag creates no route for a direct public launch and cannot add a ceiling row
• define one root-endpoint-only ttyd bootstrap-session request whose explicit operation subset is limited to native-command read, write, enumerate, create-entry, unlink-entry, rename-entry, exact-entry metadata-read and touch families plus session inspection; generic metadata mutation and process control are excluded, success echoes the complete selected policy, and exactly one lifecycle sender is transferred
• define receipt-free inputd-to-ttyd push bodies whose authenticated route carries producer identity while ttyd, not inputd, binds current focus and any pending powerbox-prompt correlation; inputd's public status reports only a monotonic count of exact trusted acknowledgements as non-authoritative test and operational evidence
• define a receipt-free powerboxd-to-ttyd grant-view update whose authenticated private route supplies producer identity and whose complete active/remove evidence remains descriptive data; grant, process, slot, and object identities cannot select or transfer authority in ttyd
• define exact procd-to-ttyd session provisioning that binds one staged process, policy, receipt-slot set, a committed lifecycle destination, and the selected standard-stream destination set to the corresponding endpoint receipts. The selection may be empty when launchd supplies all three exact stream endpoints; none of these numeric fields is treated as authority
• define the authenticated launchd-to-procd final-install request that moves one staged-child install grant plus every explicit standard-stream endpoint to procd, optionally moves one script-launch sender through an exact three-slot source/staging/child binding, optionally moves one authenticated-manifest- required job-bound CPU-accounting sender or syntax-selected public wall-clock sender through one mutually exclusive exact three-slot binding, binds them to the complementary ttyd selection and all exact fixed child slots, and returns only the resulting session and PTY identities. A zero source/child pair with no TTY bit explicitly defers that standard descriptor to the later authenticated dynamic-description install; a half-present pair is invalid
• define a launchd-only loader preparation request that carries one exact read-only executable receipt and a distinct procd staged materialization commit; success binds the executable identity, launch transaction, process, generation, materialization correlation, verified executable-content and complete-runtime-graph digests, and the sole moved install-grant receipt plus its exact procd reinstall destination, without returning a process endpoint or starting the child
• define a separate authority-free, root-endpoint-only loader service request that binds one canonical runtime-graph path to an exact service role and child endpoint, then returns exactly the staged process endpoint and install grant at fixed caller destinations; success also binds the exact executable content digest and mapped image half-open bounds used in the child's startup identity, while failures publish no process, digest, bounds, or capability identity
• define streamed launch-intent, executable-object-identity/content-bound launch-manifest, object-bound powerbox, and trusted-prompt bodies without treating selectors or numeric slots as authority; the launch program record commits the staged child's tty-session lifecycle destination before provisioning
• define launch-intent shared open descriptions that transfer exactly one operation endpoint plus one independent cleanup-only endpoint, followed by authority-free sparse u64 descriptor aliases; only the operation endpoint can be selected for child installation, while the exact nonzero stream digest authenticates idempotent release through the cleanup endpoint
• define a description-backed standard-stream flag that transfers no inherited fixed sender and binds the descriptor role to the unique separately authenticated description at the exact child slot. The description remains the sole operation-authority source and launchd retains its cleanup route
• define authority-free provisioned-stream intent records in the same canonical description-ID namespace. They bind one nonzero caller stream identity, exact child slot, directional access, and here-document-reader or pipeline role; only a here-document reader carries immutable selected body bytes, and the numeric identity cannot authorize or correlate a pipeline outside its authenticated ingress, session, and realm
• define the canonical allocation-free LCS1 launch-child startup image: one exact v1.8 header binding the child's actual nonzero lifecycle process ID, an optional flag-gated distinct stable POSIX-visible identity, and an optional route-bound script-envelope cross-check, plus the validated inherited ignored-condition set and the SHA-256 identity of the authenticated canonical command entry. Zero stable identity exposes the actual identity; neither number selects a process or conveys authority, followed by contiguous indexed arguments, portable environment name/value records retaining exact set/unset, export, and readonly shell attributes, child-slot-ordered shared open-stream descriptions, and strictly increasing sparse descriptor mappings. Sparse aliases use one child-local namespace in which identifiers zero through two name the implicit fixed standard streams and explicit descriptions begin at three. Child capability slots, description identifiers, and descriptor numbers remain data until the installed inventory authenticates them; the complete image is borrowed from caller-sized storage and carries no capability authority.
• define a process-control-only, staged-generation-bound startup configuration operation that installs the image address and length in initial rdi/rsi, preserves the independently bound receive endpoint in rdx, and makes exact retries idempotent without accepting changed or stale configuration
• require procd process queries to carry both the descriptive process ID and exact staged generation, so PID reuse cannot substitute another incarnation during lifecycle reconciliation; the pair remains authority-free and usable only through an already-held procd route
• let procd event polls either select the next route-visible event with a zero/zero selector or consume one exact process/generation event without disturbing unrelated queued observations; partial selectors are invalid and neither form adds authority beyond the held route
• define two fixed, receipt-free Integration stress-batch bodies capped at 32 exact identities: launch admits one exact executable contract, and observe consumes only the supplied process/generation pairs with one required status; unused suffix rows must be zero and duplicate identities are rejected
• return that exact descriptive generation through successful procd materialization and loader path-launch replies, while keeping failures identity-free, so a caller can issue a generation-bound lifecycle query without inferring or receiving authority
• define the receipt-free launchd-to-procd startup stream: begin binds the exact staged generation, optional distinct stable process identity, counts, total size, and SHA-256; each sequential fragment repeats immutable record metadata while procd constructs canonical prefixes; commit returns only the configured child address, size, counts, and digest. Per-message transport bounds do not cap the logical image.
• define a separate launchd-only procd description-install operation that accepts exactly one send-only operation endpoint in a fixed one-use staging slot, matches it to the just-accepted LCS1 description, installs only the exact child slot, and returns no authority; uncertain success requires staged- process abort and every outcome retires the staging alias
• define exact powerbox peer bodies for scoped VFS resolution, broker-alias detachment, receipt-free terminal object retirement, ttyd session policy, and staged-child procd installation; every success binds correlation, session, realm, job, operation, lifetime, class, slots, and object identity
• define receipt-free exact-entry mutation bodies whose endpoint selects the complete source path: mkdir, unlink, and rmdir carry no path or name, while rename carries only one validated destination basename in the same bound parent
• define separate receipt-free exact-entry metadata-read and timestamp-update bodies for native touch: endpoint identity selects the retained parent and entry, stat carries only request correlation, and touch carries only an exact access/modification/no-create mask plus explicit access and modification values. Neither body accepts a path, mount, namespace, handle, change time, or capability slot
• define the provider-private exact-entry bind/stat/mutate ABI used only by vfsd: bind accepts one canonical mount-relative path and returns an opaque handle that retains the parent plus target identity or absence; stat carries only that handle, while mutation carries the handle, VFS-derived source basename, and any operation-specific values, never a mount, namespace, parent, or source-path selector
• preserve every provider v1 operation and add private v2 mutation identifiers whose request bodies append one validated, authority-free Unix timestamp. Only hardware-RTC and degraded trusted sources are representable, precision is nonzero, epoch zero remains valid, and metadata v2 carries inode-change time independently from caller-selected access and modification values. Response layouts remain unchanged and consumers must validate the exact request/operation echo. Providers receive timestamp data, never timed or RTC authority.
• define timestamped exact-entry touch as an additive provider v2 operation: explicit access and modification values remain caller-selected descriptive data, while only vfsd supplies independent trusted current change time. The untrusted v1 fallback cannot fabricate change time and neither form transfers timed or RTC authority to a provider
• define a separate authority-free launchd-to-ttyd query that returns an active parent session's complete operation set, lifetime ceiling, and exceptional default; this prevents launchd from guessing the child session policy
• define a distinct launchd-to-vfsd launch-artifact resolver and release pair that resolves an executable or its canonical .lmf sidecar from the same delegated scope and binds the committed transaction, session, realm, delegated directory scope, selector digest, canonical manifest path, pinned-object identity, metadata, and exact endpoint receipt without treating the returned path as authority
• preserve exact executable-selector absence in the generic launch COMMIT failure vocabulary so POSIX callers can distinguish searchable VFS NOT_FOUND from loader, identity, manifest, policy, and materialization failures without receiving filesystem authority
• preserve exact loader image-format rejection as a separate INVALID_ARGUMENT launch class so POSIX ENOEXEC fallback cannot be selected by permission, identity, policy, or materialization failure
• distinguish ordinary launch commits from route-authenticated successor commits. A successor requires the owning script route, returns no new public job endpoint, and binds one exact running predecessor generation to one exact configured staged successor generation through launchd's private procd route. A nonzero stable startup identity is also valid for an ordinary launch; the selected operation and authenticated endpoint choose lifecycle behavior, never the descriptive numeric identity
• define the disabled-by-default native-redirection wire contract: launchd can register and idempotently unregister one transaction-bound resolver receiver; a request transfers exactly one cwd scope and a successful reply returns one operation endpoint plus a distinct cleanup-only endpoint, while every failure is authority-free and cleanup release carries no receipt. A distinct receipt-free adoption request binds complete source and target resolver identities in one realm so vfsd can move only the source resolver's remaining stream records before retiring it during a committed successor launch
• define a receipt-free exact-current-directory path read whose authenticated endpoint selects one already delegated, job-lifetime READ_METADATA directory. The request contains only nonzero correlation, and successful replies expose a canonical absolute path as descriptive data without a handle, namespace selector, capability slot, or authority receipt
• centralize complete caller-selected capability retirement so transient kernel backpressure cannot become a private cleanup attempt ceiling
• distinguish discovered physical device identity from activation-policy identity in device reports and readback, and make provider resolution an explicit destination-and-cursor transaction
• keep all public Rust APIs documented and warning-free

Wall-clock contracts

Monotonic v1 replies additionally recognize CALIBRATED_PROCESSOR (4): elapsed ticks converted from a boot-calibrated processor clock, not progress invented per query. This classification does not authorize UTC wall time; legacy wall v1 and source-qualified wall v2 keep their separate source rules.

The original TimedNowWall*V1 wire layout remains unchanged. The TimedNowWall*V2 operation adds an explicit source status, source precision, and the monotonic frequency needed to interpret its correlated tick sample. Its civil range is UTC Unix seconds from 1970-01-01 through 9999-12-31 23:59:59 plus a nanosecond fraction. The unsigned range is intentional: pre-Unix-epoch CMOS values are rejected instead of being silently wrapped or reinterpreted.

An UNAVAILABLE result contains no civil timestamp. SYNTHETIC identifies a boot-relative estimate that must not be persisted as trusted filesystem time; HARDWARE_RTC identifies an accepted RTC base; and DEGRADED identifies holdover from an earlier accepted base after fresh hardware evidence failed.

TimedRtcSample*V1 is a separate private provider protocol. It transports one whole-second stable CMOS sample and a strictly increasing provider sequence. The bodies contain descriptive values only: they expose no endpoint, port, or clock-setting selector, and grant no authority without possession of the separate authenticated provider route.

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

The two crates are no_std. lib-ipc forbids unsafe code; the syscall crate contains one documented assembly boundary and denies unsafe operations outside explicit unsafe blocks. Both crates deny missing documentation.

The ABI is pre-release. A coordinated semantic cleanup changes producers, consumers, tests, and the manual atomically; obsolete fields and compatibility padding are removed instead of being preserved.

Status

Implemented:

• exact-width typed body parse/encode helpers across the active service and kernel-control protocols
• checked offset/count/element-size arithmetic for variable tables
• capability-transfer payload splitting and exact 16-byte descriptors
• shared authority-free call validation with exhaustive unwanted-receipt retirement and an explicit fail-stop outcome for uncertain cleanup
• allocation-free exact receipt-plan validation that rejects missing, surplus, reordered, over-righted, or wrong-provenance transfer records
• compact log submit/query bodies containing only implemented message, timestamp, filter, and result fields; unsupported metadata and reserved extension fields are absent
• compact time-service snapshot bodies containing only request identity, timestamp, clock status, and result values; blocking deadlines remain absent until the kernel can deliver them asynchronously
• compact driver-start responses containing only request identity, result, process identity, and driver status
• compact interrupt routing bodies containing only registry, mask, acknowledgement, sealing, and event-delivery state; handler registration and acknowledgement carry no caller-selected line because endpoint identity supplies it, and the delivered transfer receipt supplies the registered handler's IRQD-local slot; notifications carry only delivery identity, while seed, registration, and sealing use one full-width generation counter
• compact input routing bodies containing only event, cursor, and status state
• compact i8042 bodies containing only operation state and exact-width u8 keyboard and mouse byte values
• compact serial-driver writes containing only request identity and payload; endpoint ownership, not a caller-provided role number, authenticates access
• compact memory-service bodies with explicit operation identifiers, no ignored request flags, and no request/response compatibility padding
• compact process-lifecycle bodies containing only request correlation, operation inputs, and observable results; zero-only alignment and compatibility words are absent
• exact receipt-free CPU-time bodies for kernel-control process/generation query, launchd-private procd query, and active script-route shell/child snapshots; all counters are non-authoritative nanoseconds, and every failed response requires them to be zero
• exact read-only system-metrics bodies binding one explicit processor topology index, monotonic total/busy scheduler ticks, and allocator used/total bytes; session process enumeration advances an opaque cursor and reports only the route-selected session's generational launch jobs
• two authority-attenuating launch flags: one records explicit session- inspection intent without granting it, and one suppresses installation of the already-authenticated working-directory sender in the final child CSpace
• one canonical data-only launch-child process classification for partitioning lifecycle visibility between root and launchd's private procd route
• compact pager bodies that carry one architecture-independent non-present access kind and an explicit read-only or read-write registration policy; raw processor fault flags and compatibility tails are absent
• semantic VFS one-path bodies: open/create carry a validated, nonzero access mask, while mkdir, stat, readlink, unlink, and rmdir carry no unused flag word; the private provider protocol follows the same split
• framebuffer-console writes name their foreground ARGB value directly instead of misrepresenting the color as a generic flag field; one canonical empty control record requests trusted-chrome release, while endpoint identity alone authenticates whether that request is permitted
• caller-sized dynamic-link graph-planner storage with no library policy cap
• a sequential dynamic-link graph transaction whose variable-length object, manifest, mapped-range, and table records may themselves span transport fragments, with exact package-version text, full feature/manifest/object digests, and authoritative streamed relocation writes; the wire contract contains no graph, name, table, or plan cap
• a root-only staged boot-object relocation batch of at most 64 ordered target/value pairs, with exact process, generation, object, ordinal, and applied-prefix correlation; errors require staged-process abort, not replay
• a transaction-scoped procd materialization protocol that streams exact segment bytes and transport-bounded sequential authoritative relocation batches without source-path telemetry, whole-file buffering, fixed segment tables, chunk counts, or source and memory policy caps; the initial stack pointer refers to an ordinary submitted writable, non-executable segment; its terminal operations distinguish the legacy commit-and-start path from commit-staged; ordinary programs name no role or child endpoint, while a privileged staged service must bind both values and may request the exact process-endpoint receipt in addition to its process-bound install grant; loader failures retain the exact begin, segment, relocation, commit, staged-commit, or abort boundary; procd may further identify frame allocation, frame mapping, process-memory write, or transaction-local capability retirement
• variable-tail ordered stream read/write bodies with absolute progress offsets, range-local EOF independent of exact lifecycle state, and no authority- bearing fields
• fixed terminal-control bodies for mode, dimensions, resize, hangup, ordinary PTY events, and a separately sized trusted-event route bound to authenticated session and correlation identities
• an authority-free v1 signal catalog whose numeric identities cannot select a process, job, session, endpoint, or delivery operation; the shared disposition vocabulary contains only default and ignore because executable caught-action text remains private to its shell
• a validated inherited-disposition bit set with holes and immutable ignores rejected, plus a disjoint tagged process-kill reason and 128 + signal shell-status conversion for canonical signal termination
• exact receipt-free job and process-generation signal bodies; endpoint possession selects the job, launchd supplies the already bound exact process generation on its private procd route, and error replies carry no delivery or terminal-state data
• exact receipt-free ordinary PTY event validation: RESIZED carries WINCH and a nonzero state generation, MODE_CHANGED carries zero and a nonzero generation, HANGUP carries HUP and one exact reason, and INTERRUPT carries INT and zero; success advances the cursor by exactly one and retry advances nothing
• an exact receipt-free lifecycle context request/response that lets a child recover its current session and realm as non-authoritative data without accepting a caller-selected session assertion or a new endpoint
• exact ordinary-input and trusted-control delivery bodies for the private inputd-to-ttyd route; neither request can assert a ttyd session or powerbox correlation, and every acknowledgement echoes the exact input event identity; the inputd status response includes the resulting trusted-success count
• exact session-provisioning request and response bodies for the authenticated procd-to-ttyd route; success accompanies the lifecycle receipt and only the set of standard-stream receipts selected by the correlated request, which may be empty when every stream is explicit, while selected stdout and stderr may alias the same PTY output object only through their transferred capabilities
• exact launchd-to-procd tty finalization bodies; the request carries one launch transaction, staged process generation, session policy, install-grant source/destination, one resolved working-directory source and child destination, an optional all-or-nothing job-bound resolver source/staging/ child triple, each explicit stream source, the complementary ttyd mask, and every final child destination, while failure publishes no session or PTY identity
• exact loader prepare-path and procd commit-staged bodies; the prepare request binds one provider-pinned executable receipt, object identity, byte size, executable mode, and canonical graph-selection path, while success names both ends of one install-grant receipt plus the selected graph root's stable dependency-manifest digest and verified executable-content and runtime-graph digests; failure publishes none of those identities
• allocation-free launch transactions for program, argument, environment, working-directory, stream, and requested-authority records; authenticated working-directory records bind a selector and explicit scope to one distinct final child slot plus an optional distinct redirection-resolver destination, while explicit redirection records bind already resolved stream endpoints rather than path data; authenticated manifests bind the selected executable graph root's stable dependency- manifest digest and separate loader-measured executable-content digest plus complete-runtime-graph, command-entry, and authority-table digests so a multicall command can carry its own authority ceiling; every manifest, launch-request, script-envelope, and powerbox operation/object-class pair must satisfy one canonical semantic matrix before it can cross the wire
• fragment-independent launch transcript headers bind every complete record's sequence, kind, length, and exact bytes; authority requests also name their object class and nonzero child installation slot explicitly
• launch BEGIN declares the exact authority-receipt demand and validated inherited ignored-condition set without naming launchd-private slots; only a successful correlated BEGIN response returns a nonempty consecutive destination range reserved for that transaction, while every failure response carries a zero range
• canonical LCS1 version 1.8 startup images bind the exact nonzero u32 child process ID, optional u64 script-envelope cross-check, and inherited ignored-condition bits plus the canonical command-entry digest as non-authoritative data; order every contiguous argument, environment entry, child-slot-ordered shared open-stream description, and strictly increasing sparse descriptor mapping; use checked 64-bit counts and lengths; retain empty arguments, exact set/unset, export, and readonly shell variable state, shared descriptor aliases, exact child slots, and read/write access; reject a value on an unset declaration, NUL data, non-portable names, invalid access, missing descriptions, duplicates, and reordering; allow sparse aliases of implicit stdin/stdout/stderr descriptions without another endpoint installation; and borrow the complete image without imposing a product-size ceiling. The envelope number is zero without a child launch route; otherwise launchd derives it from the committed envelope record and authenticates later use only through its retained receiver.
• launch-startup begin, fragment, and commit bodies correlate the exact launch transaction and staged generation without a capability-transfer table. Fragment descriptors let procd generate each LCS1 header and environment prefix, require fixed description/descriptor records in one complete fragment, return exact progress for reconciliation, and authenticate the final child-owned image against one complete SHA-256 before register configuration. BEGIN and COMMIT repeat the nonzero command-entry digest so procd reconstructs the exact v1.8 header rather than trusting child input.
• launch-intent open-description records bind contiguous description IDs, disjoint caller sources, disjoint launchd receipt destinations, an exact child slot, and read/write access. Their submit calls require operation-then-cleanup send-only receipts; sparse descriptor records contain only an arbitrary u64 descriptor and a fixed-or-dynamic child description ID. Procd accepts the operation endpoint only after its fixed description fragment, blocks later startup records until installation, and uses one fixed staging alias that is deleted after the attempt. Numeric fields never substitute for endpoint possession.
• launch-intent provisioned-stream records carry no receipt or endpoint. They require exact read access for here-document/pipeline readers, exact write access for pipeline writers, a nonzero stream identity, and an empty body for every pipeline role. Launchd may create an endpoint only after committed intent, authenticated-scope, and bounded-storage validation.
• a canonical script-envelope transcript record binds one nonzero envelope identity, one distinct child launch-route slot, an exact interactive- escalation choice, and a digest-committed table of operation, lifetime, object-class, and selector ceilings; the numeric identity and slot remain data and do not authenticate the route
• capability-based launch results: commit names a mandatory status destination and an optional, distinct job-control destination and may opt into a descriptive child process ID; success may transfer only those requested ENDPOINT SEND routes, the process number conveys no selector authority, failure transfers none and returns zero identity. A dedicated read on an already-held control route may expose its zero-on-failure descriptive session/job/process identity solely for reconciliation; explicit transaction abort names only the retained transaction
• signal delivery on that exact optional job-control route is a separate receipt-free operation from cancellation; its private procd continuation repeats the exact nonzero process and staged generation and reports either ignore or canonical signal termination, never a fabricated stop/continue
• foreground PTY event reads remain observation-only and distinct from signal delivery: the exact status receiver selects the job, launchd supplies its bound process generation to procd, and both responses carry only validated cursor/event data with no authority receipt
• generational procd stop requests and replies bind the exact managed process incarnation so a stale process identifier cannot redirect cancellation
• correlated powerbox transactions whose approval returns one exact generational object grant, whose trusted prompt is bound to the session, realm, job, selector, and resolved object, and whose pending, denied, and cancelled responses reveal no object identity or installed slot; successful begin alone returns the exact powerboxd-local reserved destination for the namespace-scope receipt transferred on commit
• an exact eight-byte powerbox decision-ready notification carrying only a nonzero correlation hint; it transfers no capability and cannot substitute for reading the authenticated terminal decision
• a receipt-free denied decision distinguishes authenticated resolver absence (NOT_FOUND plus resolution failure) from permission denial; cancellation cannot report absence and every failed grant field remains zero
• exact CREATE mutations carry no alternate pathname or content-write grant; regular-file creation uses private retained-entry provider v1/v2 operations
• exact file truncation carries only correlation and the new length (16 bytes); private provider requests name an already-pinned handle (24 bytes), optionally with validated wall-clock evidence (40 bytes), never a re-resolved pathname
• additive exact contextual BEGIN and trusted-prompt shapes preserve the fixed v1 identities and carry an authenticated canonical program entry, exact job generation, and scope-relative selector for human-readable review; paths and labels are descriptive data, never capability authority
• exact receipt-free grant expiration requests that bind the grant generation, owning job and process generation, declared lifetime, and invocation/job terminal boundary before an EXPIRED response is accepted
• exact active/remove grant-view updates that repeat the complete installed grant identity and scope for framebuffer-only trusted presentation without a capability-transfer table
• private powerbox peer records that distinguish pre-job launch policy, pre-authorized routine object grants, and exceptional object-bound policy, preserve transferred-scope provenance, and require failed resolver/install responses to publish no authority-bearing output
• exact-object detach records that transfer the broker alias back to vfsd while preserving the child-facing receiver/provider, plus receipt-free terminal retirement records accepted only on the authenticated powerboxd route; both echo complete lifecycle identity without treating a slot or digest as authority
• an atomic child-populate kernel operation that installs one exact child capability and returns a distinct manage-only revocation grant; install grants remain staging-only and are not revocation authority
• powerbox begin records bind the requested child slot to one exact staged process generation before any resolver, policy, prompt, or install step
• a process-memory population operation whose byte count describes one complete caller-to-child copy rather than a page-sized policy chunk; the kernel preflights both mapped ranges before mutation
• x86-64 call, reply, notify, receive, process-exit, local-capability query, caller-local endpoint-object comparison, local-capability drop, and yield syscall wrappers
• retained x86-64 call helpers for required and optional work, retained reply delivery, and complete caller-selected local-capability retirement through transient backpressure; unchanged requests remain pending, changed malformed messages fail terminally, and all endpoints, slots, and storage are caller-supplied
• a host-report kernel-control operation that is usable only through its dedicated endpoint kind
• distinct readiness stages for post-mount services and clean completion of the deviced-owned private one-shot RTC provider; numeric report values convey no launch or process authority
• an endpoint-factory kernel-control kind that permits only endpoint creation and attenuated copying, without staged-child installation authority
• unit tests, strict Clippy, warning-denied Rustdoc, and bare-metal checks

Known contract work is tracked in ROADMAP.md. IPC_TRANSPORT_MAX_BYTES_V1 defines the single 32,768-byte kernel transport capacity. Headers require an exact, contiguous payload and reject unknown flags. A synchronous call may advertise a larger writable buffer through the syscall length, but the request and reply within that buffer remain independently and exactly framed. Operation-specific transactions carry logical objects that exceed one envelope. The 32 KiB ceiling amortizes the authenticated storage and materialization round trips used to load executable closures while keeping every byte inside the same bounded kernel copy and framing checks. VfsReadAtResponseRefV1 validates that same exact fixed response while borrowing only its initialized payload, allowing stack-bounded clients to avoid a second transport-sized value without changing wire or authority.

Memory allocation requests name frame rights, size, and alignment. The kernel selects and reports the physical subrange from a delegated RAM allocator domain; vspaced receives only the resulting frame and VSpace capabilities and cannot nominate or bind an ordinary frame to a physical address.

Governance Principles

lib-ipc governs representation, not endpoint ownership.

• A parser validates bytes; it never authenticates a caller.
• An operation identifier describes a request; it does not grant permission to invoke it.
• Capability authority comes from explicitly delegated kernel objects, and transfer acceptance policy belongs to the endpoint owner and lib-capabi.
• Logical objects larger than the chosen transport limit use checked, operation-specific transactions rather than silent truncation.
• Git dependencies use full 40-character commit rev pins. Integration source revisions and CI caches preserve those identities, with no branch-head or synthetic-commit substitution.

Library Boundaries

• lib-ipc holds no runtime capability, allocator, filesystem handle, device, clock, logger, or service-discovery authority.
• ipc-syscall-x86_64 acts only on explicit arguments. Host-visible reporting is not a syscall: the kernel accepts it only through an explicitly delegated host-report endpoint.
• Kernel transport checks, service dispatch, caller identity, and capability installation remain outside this repository.

Contact

Development occurs in the EriX organization. Decisions and rationale are recorded in issues and design documents.

Maintainers can be reached at admin@erikinkinen.fi.