[FEATURE] Audit authority, code quality and documentation in lib-ipc #1
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/lib-ipc#1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and motivation
This issue tracks continuous Phase 6 audit closure for
lib-ipc. Define IPC wire formats, transfer receipts and service operation contracts, including the nested x86_64 syscall shim.An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.
Proposed behavior and scope
Staged construction without root capabilities — 15 September 2026
Add kernel-control operation 54, CREATE_STAGED_PROCESS_WITHOUT_ROOT_CAPS, and checked StagedProcessWithoutRootCapsV1 scalar framing. Successful creation returns a live Created process and nonzero generation whose CSpace contains exactly its requested primary endpoint, with no CNode, VSpace or TCB capabilities. Native CSpace/TCB/VSpace objects and the process's VSpace lifetime reference still exist. No child code executes during construction. The endpoint initially retains its ordinary full endpoint rights; operation 53 independently narrows it before bootstrap execution.
Keep the existing creation operation 32 and its producer behavior unchanged. The new selector is independently recognized: an older kernel refuses it, and callers must not fall back to old ignored flags or a child self-report. Admit it only on the existing Process endpoint family, without adding a capability type, endpoint factory or ChildPopulate creation authority.
Use the existing fixed request envelope. arg0 contains the caller-local install-grant destination in its low 32 bits; its upper half is zero. arg1 low/high halves contain child-local primary endpoint and caller-local endpoint-master destinations. arg2 low/high halves contain the child window base and optional caller-local VSpace destination. arg3 contains the 32-bit window length, with a zero upper half. Flag bit 0 means that the VSpace receipt is requested; all other flag bits are zero. When the bit is clear, arg2's upper half must be zero. This explicit presence bit distinguishes an omitted receipt from a real receipt in slot zero. All slot fields retain their full unsigned width; slot zero and otherwise vacant former root positions are ordinary requested slots, subject to native bounds, actual caller-window visibility and occupancy. The checked codec validates framing, not native capacity or authority. The native constructor requires a valid child window containing the primary endpoint.
The caller receives only its actual unique stage-bound install grant, endpoint master and optional MAP-only VSpace receipt. The grant is bound to the returned process/generation and exact child window. Existing capability ceilings, actual object identity and explicit disposal rules remain in force. Temporary native setup bindings must be gone before constructing the final primary endpoint and publishing the grant; otherwise former root positions would remain an unnecessary destination restriction. The TCB's independently held VSpace reference must keep backing alive even without any child or parent VSpace capability.
On failure, destroy the partial child and dispose only successfully created parent receipts. Preserve pre-existing or overlapping destinations and the original failure; uncertain cleanup fail-stops. Never treat a requested slot as evidence that its capability was created. The new contract supplies an initial inventory, not a permanent prohibition on later explicitly authorized installations or a sealed realm. The returned grant remains a real pre-start population authority that its owner must account for and retire.
Required checks include full-width codec/reserved-field cases, omitted versus slot-zero VSpace receipts, zero/former-root/last-slot endpoint destinations, invalid or inaccessible windows, occupied/overlapping outputs, exact parent and child inventories, no residual native objects, mapping/startup backing retention, attenuation through the actual grant and abort/terminal cleanup. Actual CPL3 creation/refusal/disposal must complement host tests. Procd adoption must select this operation only for the mediator role and preserve all ordinary start gates until authenticated grant return, minimum typed startup, retained native/nested guards, readiness, configuration/seal and fair retirement are independently implemented. No runnable realm or guest build is established by this constructor alone.
Native staged endpoint attenuation — 15 September 2026
Add kernel-control operation 53, ATTENUATE_STAGED_ENDPOINT_WITH_GRANT, with a checked ProcessBoundEndpointAttenuationV1 request. This is a new recognized operation; an older kernel must refuse it, and producers must never fall back to an unchecked or post-execution self-report. No syscall number or service endpoint permission is added.
Use the existing fixed KernelControlRequestV1 layout: arg0 low/high halves are the caller's actual install-grant slot and child endpoint destination; arg1 is the exact 32-bit rights mask, with its upper half zero; arg2 low/high halves are expected process and staging generation; arg3 and flags are zero. Both identity components are nonzero. Zero rights means exactly zero, never inheritance. Successful response values are zero.
The native handler must validate the actually held GRANT-bearing install grant, its record, exact expected process/generation, live Created child, grant window, endpoint type ceiling and actual primary endpoint slot. Its rights ceiling must cover the current endpoint rights as well as the requested result; a narrow installer cannot manage a broader existing binding. The new rights must be known, valid for endpoints and a subset of current rights. Update only that existing binding's rights, preserving native object identity, all other bindings and revocation associations. The change allocates no alias and needs no new destination. Repeating the same attenuation may succeed; restoring a removed right must fail. Running, dead, stale, foreign, missing and wrong-type targets must fail without effects.
Admit the operation only on the same Process and ChildPopulate control kinds as exact process-bound installation. Endpoint possession and descriptive IDs alone are insufficient: the actual held scoped grant remains mandatory. The immediate consumer is the future Procd bootstrap transaction, after the actual broad grant returns from Launchd. It will reduce the staged mediator's initial full endpoint to RECV before any private execution, providing independent native proof of that boundary.
Required coverage includes codec/reserved-field rejection, missing and moved grant, wrong process/generation, wrong target/type/window/ceiling, exact attenuation and retry, attempted amplification, post-start refusal, actual CPL3 effect checks and full cleanup. This primitive alone does not admit mediator execution: authenticated grant return, native lifetime and nested revoker custody, minimal root/bootstrap inventory, readiness, configuration/seal and fair retirement remain separate gates. The current ordinary start prohibition stays in force.
Staged mediator handoff contract — 15 September 2026
Reserve Loaderd operation
0x654(PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class0x448(REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation0x652keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted.Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop.
Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate.
This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance.
Current inventory: 37 Cargo targets (2 lib, 35 test); manifests:
Cargo.toml,ipc-syscall-x86_64/Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.Trace authority-bearing values across callers and public APIs; prove that the library does not acquire hidden service, hardware or host authority. Treat startup/teardown and rootd parity dimensions as caller/consumer contracts where this crate owns no process, with a separate evidence-backed applicability decision per row.
The initial missing-docs gaps at
tests/job_authority.rs,tests/launch_inherited_description.rs,tests/process_metrics.rs,tests/serial_input.rsandtests/vfs_touch.rsare corrected with useful crate rustdoc and explicit lint enforcement in WIP PR #2, signed revision5ff18b2bf62d3103e5b84aa92d1dc1cd096e9725. The same checkpoint adds a pure checked representation of all nine existing native result codes, preserving unknown values and requiring separate route/completion/cleanup context. Its full local IPC/shim matrix passes without warnings; broader authority, private documentation and consumer audits remain open. This does not close the aggregate criteria below.Current signed checkpoint
de6892790de69f40f749c393d24078b287b36175also defines the consumed local lifetime-revocation ABI/shim from Kernel issue 7. Both crates pass the 52-command strict local matrix, emitted register review and push CI 333/PR CI 334, with no warning candidates. Kernel enforcement, native VM/producer acceptance and the new manual/API refresh remain open in WIP PR #2.Planned native terminal-generation contract — 17 September 2026: Introduce operation 55 for exact native process/staging-generation/event-kind/status observations. The request has zero flags and arguments; malformed requests fail before dequeue. Successful responses preserve all four 32-bit fields, captured with the actual native terminal transition and retained after destruction. Empty queues return RETRY with zero values. These records constrain existing authority and confer no process-control capability.
Kernel, shared IPC, Procd and Rootd migrate together. Procd must match the native process/generation pair before cleanup, CPU-time observation, restart or service-event publication. Remove the superseded identity-free native selector after all maintained consumers migrate, with no fallback on unsupported kernels. Preserve queue reservation, ordering, wake and failure semantics. Validate actual exit/kill, generation reuse, empty/malformed input and cleanup failure, then strict component checks and original bounded native VMs on a coherent immutable revision graph.
This is the terminal-observation prerequisite for typed mediator bootstrap. The actual returned install grant already has a generation-checked endpoint-attenuation primitive for the first bootstrap effect. Guard custody, final receiver readiness, sealed publication, two mediators with real client I/O and both full guest builds remain separate mandatory work; this planned contract implements none of those by itself.
Authority, security and reliability
Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.
Acceptance criteria
missing_docsenforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.Alternatives and tradeoffs
Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.
Owned invocation wire contract — 15 September 2026
This v1 contract connects the Kernel's native request/result custody to explicit
userspace peers. It is tracked in kernel #11 and lib-ipc #1.
Shared codecs alone do not establish native execution or realm acceptance.
Registers and ownership
All numbers and packet fields are unsigned. Packet integers are little endian
and require no alignment. RAX selects the syscall; arguments are RDI, RSI, RDX,
R10, R8 and R9 in that order. Unlisted arguments must be zero. Return RAX is an
ordinary IPC result code; RDX carries the operation-specific value below and
R8 is zero. A rejected operation returns zero RDX unless SUBMIT explicitly
reports a retained draining owner. Calls do not retain any userspace pointer.
IDs are nonzero opaque numbers, scoped to the actual current process, generation
and CSpace. They never choose a process or grant capability authority. REGISTER
requires an existing generic endpoint. SUBMIT requires SEND and additionally
GRANT for capability inputs. CLAIM and COMPLETE require the exact registered
receiver and actual RECV; capability completion additionally requires GRANT.
RELINQUISH acknowledges only an invalidated delivery owned by that serving
process; it does not require a surviving receiver capability. RELEASE abandons
future collection and starts native retirement, without undoing provider effects.
SUBMIT may return a nonzero failure code AND a nonzero invocation ID: ingress
could not be completed but native disposal remains accounted to that owner.
It cannot subsequently be delivered. The caller must retain that ID for progress
and release. A nonzero code with zero ID is an ordinary rejected submission.
CLAIM/COLLECT return RAX zero after a committed delivery even if subsequent
native disposal is draining; the receive header carries that distinction.
Their rejection leaves the receive packet and destination inventory unchanged.
COMPLETE accepts its result exactly once. Repeated COLLECT is descriptive: no
second capability transfer, and the destination list must be empty.
Packed transition uses bit 0 for draining and bits 32–63 for its nonzero native
code; all other bits are zero. Complete is exactly zero. Packed progress uses
bits 0, 1, 2 and 3 for request delivered, completion accepted, result collected
and draining; bit 4 says a first error is present, with that nonzero code in bits
32–63. All other bits are zero. Draining may have no first error when release
awaits server bookkeeping. Progress flags report history, not new authority.
Input packet
The fixed header is 40 bytes, followed by capability inputs and then payload.
The exact packet size is
40 + 8 * capability_count + payload_bytes.OIV1Each capability input is a four-byte current source slot and four-byte requested
rights. COMPLETE requires both result budgets to be zero. The kernel copies
input bytes and retains actual admitted native bindings before returning; caller
mutation or unmapping after return cannot change the accepted request/result.
Possession, type, attenuation, provenance and lifetime checks remain native.
Receive packet
The fixed header is 64 bytes, then four-byte destination slots, then twelve-byte
receipt capacity, then byte capacity. Its exact size is
64 + 4 * destination_count + 12 * receipt_capacity + byte_capacity.OIR1Destination and receipt capacities are distinct to support repeat collection.
First delivery requires enough destinations and receipts for all actual inputs;
only the used destination prefix is validated or populated. Spare destinations
and unused receipt/payload capacity remain unchanged, acquire no authority and
are not returned as evidence. A receipt is destination slot, native capability
type and admitted rights, each four bytes. It describes a committed transfer,
not a transferable capability. CLAIM supplies the retained caller's process and
generation. COLLECT leaves those two fields zero. No caller-supplied identity is
accepted. Output counts must fit capacities; draining requires a nonzero code.
Validation and lifetime
Overflow, size mismatch, noncanonical headers, unsupported versions, nonzero
initial output fields and reserved register inputs reject before native custody
changes. There is no inherited 32 KiB CALL limit. Actual addressability, native
CSpace limits, caller budgets and fallible allocation still constrain admission.
The entire input span must be freshly readable; the entire receive span must be
freshly readable and writable in the current process's actual VSpace. Kernel,
noncanonical, stale, overflowed and partly inaccessible spans reject.
Mapping validation, packet admission, native effects and output publication share
one existing process-lifecycle exclusion interval. All allocation and fallible
output checks precede native delivery. Destination input is snapshotted before
outputs are written. No userspace pointer, borrowed descriptor, receiver-selected
CSpace or ambient allocator/provider authority enters retained custody. Hosted
raw-pointer dispatch is refused; safe codec/object tests and actual CPL3 tests
provide distinct evidence. Existing CALL/REPLY semantics remain unchanged.
Acceptance and rollout
Literal packet fixtures, arithmetic/malformed negatives, complete and draining
returns, spare destinations, repeated collection, exact-owner refusal, revoked
bindings, fresh mapping checks and real CPL3 request/capability round trips must
pass. Existing unit and VM regressions remain mandatory. Producers and consumers
select original signed commit pins after strict validation. Realm lifecycle and
complete in-guest builds remain separate gates. A peek/sizing syscall is avoided
by admitting capacity; numeric identities never bypass native ownership checks.
Shared owned-invocation checkpoint — 15 September 2026: Define owned invocation packet codecs and immediate syscall transport, preserving complete raw custody metadata and the existing hosted transport refusal. Signed
de968da19898bef532ddb3b5974bb9562f51dee5passes default/all-feature development/release unit tests (368 IPC tests and 20 shim tests, with one existing native-only host ignore), strict all-target host and freestanding Clippy, warning-denied freestanding builds, private rustdoc and Markdown checks. Kernel dispatch and actual owned CPL3 peers remain dependent work in kernel #11. Shared codec tests do not establish realm runtime or either complete in-guest build generation. Current component CI remains pending.Owned invocation wire and native acceptance — 15 September 2026: Signed Kernel
5f497adaefa526108a0439e0e071717dddb85334, shared IPCde968da19898bef532ddb3b5974bb9562f51dee5, capability ABIa001a26f0eb3aebec3f5fd02a28d98f1bc23f8a0and Integration9030b217c490db6ad3ec60a799cb025eccbfcdb1implement and exercise the immediate owned invocation boundary. The allocation-free shared codecs and shim preserve exact return metadata, including a retained draining owner on failed submission. The Kernel checks fresh complete user mappings and packet framing under one lifecycle guard before native effects. No user pointer or caller-selected identity is retained. Destination capacity and descriptive receipt capacity are independent; spare capacity acquires no authority and repeated collection cannot duplicate transfers. Existing numeric binding hints still recheck live capabilities on every use. The real three-process CPL3 scenario passes all eight operations, full-span pointer/rights/overflow/reserved-field rejection, actual returned selectors, payload/capability/origin checks, collection after server exit and repeated receipts. A second request rejects premature relinquishment, enters draining on caller release and retires only after the exact server acknowledgment. Current signed owned and unchanged older lifetime images are each 2,232,320 bytes, with SHA-256588c6097c57ebd2ed92e0f0b76f2b1ad6b82630b4a0da272ee98e218eb8e333dand8f9026aaefd2c5a745e35467ac01c71789c5f469f9cd42a477f87818747ee673respectively. Both runs have clean teardown and empty QEMU stderr. Ordinary images contain neither diagnostic hook. Strict default/all development/release host, freestanding and rustdoc matrices pass: IPC 368 units, shim 20, capability ABI 191, Kernel 642/666 and Integration 320/321. Existing ignores remain one shim and three Kernel tests. All 162 maintained Integration helper commands pass; three prior correct concurrent-run lock refusals are retained and their sequential checks pass on unchanged executable inputs. Docs46da7a4cb4d38a2bea5b5491a68f51f33e4b4305publishes the normative register/packet contract and regenerates the three affected API references from original signed revisions. All 45 documentation tests pass. The complete 2,363-page manual has zero final warnings, 430,365 word boxes within page bounds and reviewed changed ABI/API pages. Shared IPC CI 337/338 and capability ABI CI 214/215 pass with eight complete warning-free logs. Both Kernel revisions pass CI 556/557 and 558/559 with eight complete warning-free logs. Those cohorts are stopped. Current Docs CI 867/868 passes at observation four; four complete logs total 758,328 bytes. Both 2,363-page manuals pass all 45 tests, report normal reference-pass warnings of 32/1/0, and finish with zero warnings or box diagnostics. Its cohort is stopped. Current full Integration 1621/1622 is waiting. Older full Integration 1613/1614 now passes all 486 catalog scenarios and later native/console probes, with six complete warning-free logs; its cohort is stopped. Older 1615/1616 is running, and 1617/1618 plus 1619/1620 are waiting. Current full-suite acceptance remains open, as does the intermittent quota cause in Integration issue 18. This checkpoint supersedes the earlier pending wire/CPL3/manual status. Reachable backend disposal-failure coverage, broader revocation/generation-reuse scenarios, producer adoption, realm runtime, complete authority/inline-documentation audits and both full EriX-in-EriX build generations remain open. The current inventory checks 76 repositories, 2,943 code files below 1,000 lines and 157 crate roots with direct missing_docs gates; it does not establish semantic audit closure. No complete guest build or guest performance result is claimed.Typed realm bootstrap installation design — 15 September 2026: The next bootstrap producer step requires validating the actual moved install grant against the intended child before any installation. Add Kernel-control operation 52, INSTALL_WITH_GRANT_FOR_PROCESS, using the existing fixed request/reply envelope: flags and arg3 are zero; arg0 packs grant slot in bits 0..31 and source slot in bits 32..63; arg1 packs child destination slot and exact requested rights; arg2 packs nonzero process ID and nonzero staged generation. Both response values remain zero. The operation is admitted only where grant installation is already allowed (process-control and child-population endpoints, with existing bootstrap control policy preserved). The held unique grant remains the authority; the supplied process/generation pair is an additional equality constraint, never a target-selection grant. Revalidate exact native grant binding, GRANT possession, child/staged identity and current staged liveness, slot and type/rights ceilings, actual source binding and empty destination before transfer. Unlike legacy zero-means-inherit installation, this operation always uses the exact supplied rights, including zero. Reject nonzero reserved input and zero identities deterministically; mismatched target identity must produce no installed alias or new revocation lineage. Keep old producer semantics unchanged until explicitly migrated. Share the native installation implementation and split the existing near-1000-line control dispatcher by responsibility. Tests must use actual moved install grants for distinct staged children, wrong/stale generations, occupied destinations, explicit zero rights, invalid fields, denied endpoint policy, preserved source/grant custody and native lifetime/revocation behavior. Connect the new checked operation to typed Procd bootstrap provisioning; a standalone scalar codec or host-only table is not realm runtime acceptance. Complete receiver readiness, setup-authority disposal, fair terminal/provider scheduling, two-realm byte I/O and both full guest builds remain required.
Process-bound native acceptance — 15 September 2026: Signed Kernel
60da5858d7198185efd103f0e91e5ac2e0b63e67implements control operation 52, checking the actual moved install grant against expected process/generation with exact rights, including zero, under existing endpoint policies. Signed Procdf1105706cc19ed024a6cca79a29abc57c90c6661uses this operation in its actual ordinary launch-description producer while retaining the narrow SEND receipt, pending state and exact failure cleanup. IPCc453b697b8cdb9cc1c36f1ad89ff868648190025, capability ABIfe8d558253ad01301b99554e20d287c4ea35bb1dand five aligned helper commits preserve original Git/type identity. Integration58c925c564b69bebce8df6f3e75a9312824e18c4passes the expanded lifetime CPL3 scenario with thirteen actual control calls, user-side reply checks, two staged children and full added-custody disposal. The corrected lifetime image SHA-256 is8e6a9e8f68b90cc1ede61300958cec122b82a7c6dfd6318a51e40fefc7ba166e; the unchanged owned-invocation scenario also passes with image SHA-256b76a380d3cd6b03b0ff61a3b626ace0667679920684ad7356a1c3a36e2224953. Both have clean teardown and empty QEMU stderr. The initial fixture setup-order failure is retained and corrected in Kernel issue #14. All strict default/all development/release matrices pass: IPC 371, shim 20, capability ABI 191, Kernel 648/672 including standalone controls, Procd 227/232 including auxiliary binaries, and Integration 320/321 tests. Existing native-only ignores are unchanged. Procd passes forty native binary builds with repository linker scripts. All 162 Integration helpers pass after updating the exact policy assertion to require the new marker; its initial mismatch remains recorded. Docsb0fcf0f43af2af741d520a0b1373cc346e08863cupdates the native wire/ownership contract, operation registry, Procd boundary and three generated shared APIs. All 45 tests and the complete 2,367-page manual pass, with zero final warnings, 431,138 word boxes within page bounds and four reviewed protocol/API pages. Current IPC 339/340, capability ABI 216/217, Kernel 560/561 and 562/563, Procd 266/267, Docs 869/870 and all five helper push/review CIs pass with complete classified logs and no final warnings. Those component cohorts are stopped. Current full Integration 1623/1624 waits at observation 01. Older full Integration 1615/1616 is running at observation 11; 1617/1618, 1619/1620 and 1621/1622 wait at observations 09, 07 and 04. No pending full suite is counted as passed. Typed realm bootstrap, mediator startup/readiness/configuration/seal, complete consumer image adoption, fair terminal/provider retirement, broader native disposal failures and both full EriX-in-EriX build generations remain open. The new inventory covers 76 repositories, 2,950 code files below 1,000 lines and 158 direct missing_docs crate-root gates; complete inline documentation and whole-codebase authority closure remain open. Prior performance measurements retain their original signed source identities; this checkpoint claims no new timing or guest performance result.Staged mediator source checkpoint — 15 September 2026: Signed Loaderd
adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd64b563482c9ecab115283fe56c8562d948fbbabdand Procdcdb0fe4d1496073521626ce21f0fa2c95a81bd36implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC5fa5fdb2edbfe963efae1c11f99a3a58d0062509and capability ABIe5a3e864491479981b9ab37749109dafe52fa330plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.Native bootstrap destination correction — 15 September 2026
The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI
c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5corrects the constant; Kernelb98156427362a468ae78195a3582901e2474fea5adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.Corrected native staging checkpoint — 15 September 2026: Signed source
5fa5fdb2edbfe963efae1c11f99a3a58d0062509is recorded in the current review. Define separately correlated exact-executable mediator preparation and the isolated lifecycle class alongside owned invocation and process-bound installation. 371 IPC tests and 20 syscall-shim tests pass in all supported strict matrices; one existing native-only host ignore remains explicit. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.Native terminal generation checkpoint — 17 September 2026: Signed revision
0e35b99d97064f54b2b14c23a9e0f0079246c083is pushed. The checked operation 55 codec preserves the original process generation, validates reserved requests and canonical empty-queue results, and retires selector 7. Seven new wire/malformed-input tests pass. Default/all-feature development and release units, strict host/native Clippy, freestanding builds, rustdoc, formatting and Markdown checks pass. Native producer/consumer migration, matching VM execution and full guest builds remain separate acceptance gates. Original automatic CI is being collected without retries.Planned exact-generation native cleanup — 17 September 2026: Define distinct native terminal-destruction and
staged-abort operations 56 and 57. A checked request carries the nonzero original
process/generation pair in the low/high 32-bit halves of arg0; flags and all other
arguments are zero. Retire selectors 8 and 35 without reinterpreting them or
adding a compatibility fallback. The existing held Process or Root route remains
required; descriptive identities do not grant authority.
Match the exact pair under the same TCB record lock that enters retained cleanup.
Preserve terminal-versus-Created eligibility, partial disposal and retry custody.
An absent or different generation acknowledges absence of only the requested
instance, with zero response values; it cannot mutate a replacement. Migrate
every native caller and carry creation/event generation through deferred retries.
Account for processes created before a service's own managed ledger without
reconstructing historical identity from the current record. Maintain separate
terminal observation, cleanup custody, provider completion and native absence.
Required evidence includes exact wire and reserved-field controls, actual-object
generation/reuse and failed-release controls, consumer cleanup tests, and bounded
CPL3 native coverage. Update all operation inventories, Rootd's measured audit
contracts, canonical documentation and manual/API references. Validate coherent
original commit dependencies, complete strict component matrices and repository
CI checks, then monitor original workflows. Ordinary mediator start, whole-image
admission and both complete builds inside EriX remain separate open gates.
Generation-bound native cleanup checkpoint — 18 September 2026: Signed revision
e4781c0bdb725d867c2f6bb6a783283ca04b2fc5is pushed. The shared checked cleanup codec defines operations 56/57 with original process/generation identity, canonical reserved fields and zero result values. Selectors 8/35 are removed. Six new wire controls and the complete strict host/native matrix for both crates pass. Formatting and Markdown checks pass. Original CI 351 and CI 352 passes; all four terminal logs are complete (459,587 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Returned-grant bootstrap custody design — 18 September 2026: Add distinct Procd PREPARE_REALM_BOOTSTRAP (0x432) on the existing
private Launchd route. The native pending caller must match a retained running
Launchd generation. Its exact 32-byte request carries u32 request ID, opcode,
original process/generation, source and original destination install-grant slots,
then two zero words. The actual sole receipt must be INSTALL_GRANT with exactly
GRANT|MINT. Slots are full-width descriptions; receipt, live inventory and native
matching-grant checks establish custody. Previously guarded, started, stale,
ordinary-role and malformed stages refuse before new effects.
Reserve exact rollback ownership first. Use the real returned grant and native
operation 53 to narrow the Created child's primary endpoint to RECV. Establish
an ancestor SEND branch under Kernel lifetime custody and a distinct nested
explicit revoker before any export. Retain the nested sender privately; dispose
the original master, unguarded sender and ancestor-only bypass aliases. The
returned install grant stays exclusively owned for later typed installation.
No new endpoint factory or expanded Process endpoint policy is implied.
The exact 32-byte capability-free reply echoes request/opcode/result/process/
generation, followed by a u32 custody state and two zero words. State 1 occurs
exactly with OK and confirms only guarded unstarted-stage custody; failure state
0 is not absence proof. Lost reply, rollback, abort, supervisor loss and terminal
cleanup must account for every reused scratch column, actual guard and exact
child identity. Uncertain disposal prevents reuse and ordinary continuation.
Keep ordinary mediator starts denied. Counted final receivers/configuration,
owned fair intake/provider/retirement progress, private execution, authenticated
readiness, initial receiver disposal, seal/publication, real two-realm client I/O
and both complete builds inside EriX remain required. Host models or this guarded
stage acknowledgment cannot substitute for those acceptance gates.
Returned-grant shared contract checkpoint — 18 September 2026: Signed revision
3a751fb9eb58a22a7f2dd6f196c8ef09ed0ce8b5is pushed. The shared checked 32-byte request/response contract defines Procd operation 0x432, full-width source/destination slots, original stage identity, reserved fields and success-only guarded-stage acknowledgment. Six literal wire and correlation controls pass. Procd IDs are extracted into a cohesive documented inventory below the physical source limit. Both shared crates pass the complete strict host/native matrix. Native consumer and producer adoption remains open. Formatting and Markdown checks pass. Original CI 353 and CI 354 passes; all four terminal logs are complete (466,911 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Caller-local grant relocation design — 18 September 2026: Add immediate x86_64 syscall
0x54,RELOCATE_LOCAL_GRANT, taking source slot in argument 0 and destination slot in argument 1. Both fit u32, are nonzero and distinct; arguments 2–5 are zero. The return is the exact result in rax with zero auxiliary value. Admission uses the actual current Running native process and nonzero generation, checks both slots against its syscall window, and accepts only an actual held INSTALL_GRANT or REVOCATION_GRANT with its matching native record. Movement uses the existing unique-record rebinding within that same native CSpace; rights, child/generation installation scope and revocation lineage are preserved. No grant is constructed, copied, attenuated or retargeted. Malformed register shape rejects before context lookup; caller/window checks precede source lookup, then type/binding checks precede empty-destination admission. Ordinary validation refusal leaves inventory unchanged. The transition is serialized with process-terminal and reply-authority lifecycle changes. Owned CLAIM already selects receiving destinations before exposing request bytes; this operation lets a producer validate the received grant and then relocate it into an existing per-process custody slot. The operation itself does not validate a bootstrap request, install child authority or acknowledge application retirement. It adds no Process endpoint selector or general CNode route. Literal register, foreign/terminal caller, missing/fake binding, occupied destination, exact-rights/scope and actual CPL3 controls are required, followed by coordinated producer/consumer adoption and the remaining realm VM gates.Caller-local grant relocation checkpoint — 18 September 2026: Signed revision
3b06ba8de988824ce1896d2664b27885636dd30dis pushed. The shared selector and safe register-only syscall helper define native operation 0x54. Literal selector and hosted refusal controls pass. The operation moves only an actual held install/revocation grant inside the Running caller CSpace and admitted slot window, preserving its unique record, rights, scope and lineage. Both shared crates pass the complete strict host/native matrix. Signed Kernel 56d398e0 passes both actual native VMs, including thirty-nine new CPL3 relocation controls; service consumer adoption remains open. Formatting and Markdown checks pass. Original CI 355 and CI 356 passes; all four terminal logs are complete (472,097 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Owned receiver request-budget contract — 18 September 2026: Extend register-only REGISTER (0x4C) to take the actual local RECV slot, maximum request payload bytes and maximum request capability count in arguments 0–2; arguments 3–5 remain zero and successful RDX is zero. Both budget values are explicit receiver declarations. Zero/zero admits only empty requests. The byte/slot/receipt receive layout must be addressable and capability capacity must fit native private CSpace storage. The actual Running generation and held generic RECV endpoint remain the registration authority. Exact repeated registration is idempotent only with the same budget; a different budget or owner conflicts without modifying the original registration. Replacement follows the existing actual receiver-binding removal and exact native retirement rules. SUBMIT compares actual payload length and capability count against that exact registration before request allocation, private-space reservation, native transfer or invocation serial acceptance. Oversized requests return ordinary INVALID_ARGUMENT with zero owner ID and unchanged source custody. The packet decoder passes its checked capability iterator directly to native preparation, removing its redundant temporary vector. Accepted invocation, result-budget, delivery, draining and retirement contracts remain explicit. Migrate every producer and fixture to the new signature without a deprecated unbounded fallback. These budgets describe service-owned receiving storage; they add no global CALL-size ceiling, user-pointer retention, foreign selector or capability grant. Literal malformed/zero/exact registration controls, rejected-inventory checks, actual CPL3 calls and existing VM oracles are required. Then connect the owned Procd/Launchd bootstrap path through its held private route, actual claimed caller identity, server-chosen grant receipt and local relocation, retaining each committed/draining owner through exhaustive cleanup. Actual consumer VMs, complete fair realm progress and both full guest builds remain open acceptance requirements.
Explicit receiver admission checkpoint — 18 September 2026: Signed revision
e452014b25650de0f9ad174d2d1697653d0459d1is pushed. The shared RequestBudget and REGISTER shim require explicit byte and capability limits. Zero dimensions, immutable exact registration, complete addressability and admission before native request custody are documented. The unbounded signature is removed. Both shared crates pass the complete strict host/native matrix. Kernel and live service validation remain independent requirements. Formatting and Markdown checks pass. Original CI 357 and CI 358 passes; all four terminal logs are complete (472,078 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Owned guarded-bootstrap service contract — 18 September 2026: Migrate PREPARE_REALM_BOOTSTRAP to native owned request/result custody on the already held private Launchd-to-Procd endpoint. Its exact 16-byte body contains request/opcode/process/generation only; remove obsolete source and destination slot descriptions. The canonical capability-free response remains 32 bytes. No legacy bootstrap transport fallback is retained.
Procd registers explicit 16-byte/one-capability request limits, supplies an actually empty local receiving slot, validates the committed receipt type and rights and matches the native claimed origin to the retained Running Launchd generation. It validates the exact staged mediator row and actual grant scope before adopting the grant into that row through caller-local relocation. Existing launch-description staging may be reused only with explicit exclusive ownership and proved completion of its former cleanup; add no broad Process authority or per-realm scratch column. Numeric identity or receipt metadata never replaces actual possession or scope validation.
The running service loop must give native retirement a turn before owned bootstrap and ordinary intake. Retain nonzero delivery/invocation owners, received authority, exact child rollback and first cleanup failure through committed/draining outcomes. Complete every independent local and child retirement action before relinquishing bookkeeping; uncertain cleanup cannot return a service to ordinary work. Authenticate actual native origin and revalidate the original supervisor before effects; do not manufacture legacy pending-caller or source-slot receipts.
Replace Launchd synchronous bootstrap exchange with retained progress driven by its actual runtime orchestration. Success requires a canonical correlated result, actual source-grant absence and complete invocation retirement. Connect this to authenticated staged realm preparation, with no public numeric shortcut into a prepared process. Preserve ordinary start refusal until realm configuration, readiness and sealing are complete.
Acceptance requires adversarial ownership/cancellation/partial-cleanup host controls, strict coordinated builds and real producer/consumer VM execution. Native primitives alone do not establish service adoption, complete fairness or a full guest build. Existing ordinary source/effect/frame and two complete EriX-in-EriX build gates remain unchanged.
Owned bootstrap wire checkpoint — 18 September 2026: Signed revision
d2f72761c11011c7f6991095ee304bca612119bais pushed. The bootstrap request now carries only request/opcode/process/generation in exactly 16 bytes; removed source/destination selectors and the old 32-byte request are rejected. The correlated 32-byte capability-free response is unchanged. Both shared crates pass all strict host/native matrices. Actual native origin and grant scope remain consumer checks. Formatting and Markdown checks pass. Original CI 359 and CI 360 passes; all four terminal logs are complete (472,116 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph.
On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant.
Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work.
Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain.
Original supervisor wire checkpoint — 18 September 2026: Signed revision
528598172136ee0db5d3733dd8eb6ca713a790d7is pushed. Materialization begin is exactly 64 bytes, with two full-width original supervisor words required for mediators and forbidden for other roles. The obsolete 56-byte shape is removed. Four new adversarial codec controls cover literal wire positions, truncation, suffixes and owner pairing. Both shared crates pass strict host/native matrices; actual caller attestation and lifecycle custody remain service responsibilities. Formatting and Markdown checks pass. Original CI 361 and CI 362 passes; all four terminal logs are complete (478,708 bytes), without warnings. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain separate open acceptance requirements.Caller-bound realm admission and retained storage contract — 18 September 2026
Use distinct Launchd operations BEGIN_REALM 0x6D0, PREPARE_REALM 0x6D1,
ABORT_REALM 0x6D2 and READ_REALM 0x6D3. The existing 0x6B0–0x6BF range belongs
to filesystem providers and is not reused. Little-endian bodies are exact, with
nonzero request correlation and no fallback to ordinary launch transactions.
BEGIN_REALM is an authority-free 8-byte request (request ID, operation). Derive
session, authority realm, original process/generation and Running job from the
actual native pending caller. Reserve an independently budgeted realm record,
a nonwrapping generation and one disjoint executable-scope receipt slot before
replying. Client numeric identities or a bearer sender cannot select ownership.
PREPARE_REALM has a 32-byte prefix: request ID and operation (u32), realm record
ID and generation (u64 each), and selector byte length (u64), followed by exactly
that nonempty UTF-8 selector without NUL. Parsing adds no pathname or packet-size
ceiling. The request carries exactly one actual SEND-only directory endpoint to
the reserved receipt slot. Verify the original caller/job/session/authority realm
again and retire every unretained received capability on refusal. Resolve only
inside this explicit directory, authenticate the exact executable and manifest,
and call Loaderd's existing private PREPARE_REALM. Never imply a Posixd pathname,
Named route, root, cwd, TTY stream, ordinary job or public PreparedProcess input.
ABORT_REALM and READ_REALM are authority-free 24-byte requests: request ID,
operation and complete realm-record ID/generation. They require the same original
Running native owner. READ observes retained state only; ABORT must complete
independent source, invocation and exact-child retirement before its successful
acknowledgment. Parent terminality initiates the same retained cleanup internally.
All four operations have an exact 40-byte capability-free response: request ID,
operation, raw result and state (u32 each), record ID and generation (u64 each),
receipt slot and zero reserved word (u32 each). States are Unconfirmed=0,
Reserved=1, Preparing=2, Guarded=3, Retiring=4 and Retired=5. Success at BEGIN
requires Reserved, a nonzero complete handle and receipt slot. PREPARE success
requires Guarded; ABORT success requires Retired. READ returns an authenticated
nonzero state. Only successful BEGIN returns a receipt slot; every other result
has zero there. Failure always has Unconfirmed state; failed BEGIN has a zero
handle while other failures echo the original complete request handle. Unknown
nonzero result codes remain full-width. Unconfirmed proves no resource absence.
Correlate the complete response with the original request before using evidence.
Replace obsolete LCH1 v2 with exact 72-byte version3 startup policy. Preserve the
first 68-byte field order and append realm_capacity (u32 at offset68). Require an
explicit deployment value: zero disables new realm reservations, and nonzero
values allocate that many retained records and disjoint receipt slots. Validate
checked job-route + stream-route + realm-receipt arithmetic before leaving any
ordinary transaction receipt storage. No default or incidental fixed array sets
realm count. Coordinate shared startup codecs, Rootd payloads, Launchd arena and
Integration policy/packaging; old version/width must reject. Extend the native
capacity descriptor with the realm record's size/alignment and a new layout
version; do not assume ordinary reply records survive long enough for realms.
Keep original child, local scope/grant obligations and native invocation owners
independent. Actual scheduler progress must exclude ordinary and indirect blocking
peer calls while any native invocation needs progress. A permanently discharged
source slot is never revisited after reuse. Native release precedes ordinary
exact-child abort; preserve first errors and exhaust independent cleanup without
returning uncertain state to normal operation. Guarded staging remains private
and unstarted, without exported SEND or a Running job. This initial admission
interface does not define configuration, readiness, sealing or publication.
Coordinated host negatives, strict source-bound build matrices and real consumer
VM execution are required. Two mediator processes, two clients per realm with
actual mediated I/O, complete fair progress, source/effect/frame admission and
both full builds inside EriX remain separate open acceptance requirements.
Caller-bound realm storage wire checkpoint — 18 September 2026: Signed revision
40edeee8f461c397e4bd6358e373f7a9185cbf34is pushed. Distinct caller-bound reservation, preparation, read and abort codecs carry no caller-supplied process or session identity. Exact UTF-8 selectors borrow input without an extra pathname ceiling; full generational handles and cap-free responses require independent correlation. Seven new adversarial controls and all eight library/shim matrices pass: 412 IPC and 20 shim tests per configuration, with one pre-existing shim ignore retained. Descriptions confer no authority. Formatting and Markdown checks pass. Original CI 363 and CI 364 passes; all four terminal logs are complete (486,490 bytes), without warnings. Actual admission dispatch, coordinated consumer VMs, runnable mediators and both full builds inside EriX remain separate open acceptance requirements.Tracking and rollout
Native child-custody wire checkpoint — 19 September 2026: signed lib-ipc PR 2,
aaf2df39700b43507b23ff2007bc0d573c4eea30, implementsChildLifetimeBindingV1, native operation 58 and supervisor-termination kill reason 4. The request preserves the exact child/generation and actual local grant slot, with no owner selector, rights mask or withdrawal form. Existing Process authority and current Running attribution remain separate native requirements. All reserved bits are rejected; replies carry zero result values and preserve uninterpreted codes. Lost replies retain the original cleanup obligation. See the shared contract and Kernel design #19.Seven new controls pass all eight strict library/shim configurations: 419 wire tests and 20 shim tests per configuration, eight freestanding builds, formatting, strict host/native Clippy and private rustdoc, with no warnings. The original kernel-only shim test remains ignored. Original lib-ipc CI 365 and 366 pass from four complete hashed logs, 494,246 bytes, without warnings. Kernel admission, descendant stopping, safe native reclamation progress, coherent consumer adoption and actual CPL3 failure coverage remain open. The shared codec does not enable private mediator execution or alter the current complete image's source graph.
The matching signed Docs PR 4,
54557713f4afad380c1166f6aa1c1622d3959744, updates the TeX chapter and both IPC API views from original signed source. All 45 tests, independent API regeneration, the complete 2,423-page manual, all 446,749 word bounds and nine visually reviewed contract pages pass, with zero final warnings. Original Docs CI 979 and 980 pass from four complete hashed logs, 773,034 bytes. Both runs pass 45 tests and the complete 2,423-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No workflow rerun or cancellation supplies this result. Native upstream Rust/LLVM rebuilding and both complete EriX build generations inside EriX remain required.Runtime dependency alignment — 15 September 2026
Signed
83e267694ee23f0986a54562adcfd8d93c326a6aupdates the existing foundation pin without changing authored Rust implementation files or wire layouts. The root crate passes 381 tests and the nested syscall shim passes 20 tests with one existing native-only ignore in every default/all development/release configuration. Strict host/native Clippy, eight native builds, private rustdoc and formatting pass with no warnings. The nested shim's original metadata was admitted separately before its locked checks. CI 347/348 passes with all logs classified and no final warnings. This is part of coherent runtime-source adoption, not a new product VM or guest-build acceptance.Coherent runtime source adoption — 15 September 2026
The product runtime catalog still selects the earlier source graph. Adopt the current original signed sources as one coherent graph before claiming product execution of the new kernel invocation, mediator construction and Procd caller-admission contracts. The frozen inventory covers 73 catalog components and 72 tracked Cargo manifests; 54 components need direct pin alignment, with further propagation after dependency commits are published.
Align dependency selections bottom-up, preserve original Git objects, and validate every altered repository under its supported strict configurations before signing and publishing its dependency commit. Full commit selectors remain mandatory. Unrelated work is preserved, and no synthetic replacement object or rewritten published history supplies build evidence. Update the runtime catalog only once all selected Cargo manifests and original metadata agree.
Run actual product images covering authenticated Launchd activity and the relevant lifecycle/authority regressions, adding negative caller controls where needed. Keep complete warning-free build/test/image evidence and monitor existing CI. Significant regressions use the canonical bug report format. Dependency alignment alone does not prove runtime authority closure, mediator execution, performance improvement or either complete guest build generation. Typed grant return and guarded bootstrap remain the next realm implementation boundaries.
Construction without child root capabilities — 15 September 2026
Define checked root-capability-free construction framing alongside the existing native authority, owned invocation and staged endpoint contracts. Signed original revision:
7c7712057cc5d16ab16a677a886caeac54814a16. All 381 IPC tests and the syscall shim matrix (20 tests, one existing native-only ignore) pass with strict default/all development/release host/native Clippy, builds, documentation and formatting. CI 345/346 has complete warning-free logs.Procd adoption, authenticated grant return, guarded bootstrap authority, private mediator execution, readiness, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase semantic authority and private-item documentation audits remain incomplete.
Staged endpoint attenuation checkpoint — 15 September 2026
Define the checked ProcessBoundEndpointAttenuationV1 request and operation 53. Preserve exact packed widths, nonzero identity requirements, reserved-field error precedence and exact zero rights. Scalar decoding conveys no capability or proof of native identity. Signed original revision:
74c75a5db226413c066b6582210a44cb21d968d8. All 376 IPC tests and the syscall shim matrix (20 tests, one existing native-only ignore) pass with strict default/all development/release host/native Clippy, builds, private rustdoc and formatting. CI 343/344 passes with complete warning-free logs.Authenticated grant return, independently minimal bootstrap/root authority, retained native and nested guards, private mediator execution, configuration/seal, client I/O, fair retirement and both complete guest build generations remain open. Ordinary mediator start gates remain closed. Whole-codebase authority and private-item documentation audits remain incomplete.
Signed Lib-ipc
805717680d9dfb902216550a111d910807f30d23selects native IPC assembly only for freestanding x86-64 builds. Other targets retain the API for tools and tests, with localDENIEDand zero raw transport outputs. Checked helpers preserve their preceding slice validation. The local refusal carries no kernel-attested identity, capability observation or retirement acknowledgment; compile-target selection itself does not authenticate a running kernel.The backend is extracted and documented inline. Three public host regressions cover register operations, empty identity/authority observations and unchanged message buffers. Static object inspection establishes zero syscall instructions in both hosted profiles before those tests execute. The native backend's emitted instruction sequence is identical in development and release. No new wire result or runtime probe is introduced.
Both crates pass formatting and the complete strict default/all-feature development/release host/freestanding matrix. Each ABI selection passes 359 units plus one doctest; each shim selection passes 18 tests with one existing native-only test ignored. Private rustdoc covers both compiled backend variants. Canonical documents, whitespace, source identities and code-size checks pass without compiler or lint warnings. Current push CI 335 and PR CI 336 pass for this exact signed source. Four complete logs total 409,239 bytes with zero warning candidates. Each test job passes 359 default ABI units plus one doctest, 359 optimized all-feature ABI units and both 18-test shim selections; the existing native-only case remains ignored once per shim selection. All three new host tests pass in both selections. The workflow also passes formatting, strict Clippy, host/freestanding builds and private rustdoc; both ten-file Markdown jobs pass.
The source-matched API export retains all 2,593 ABI and 24 shim public signatures unchanged. The platform manual is accepted at signed Docs
87942ea7675e2a25fe3bf19f3cac19f9c5d8b1e2in Docs PR 4, with all 45 documentation tests, the complete 2,339-page local manual and CI 843/844 passing with zero final warnings. The earlier native lifetime mechanism remains accepted at its separate Kernel03e13a78/ Integration4b65755fgraph, with Docs17b4d52aand green CI 841/842. New realm producers, operation completion, the broader audit and full guest builds remain open.The matching native lifetime scenario now passes with Kernel
03e13a78and Integration4b65755f, whose exact source graph selects this signed IPC revision. Docs28b44183publishes the syscall and generated wrapper reference with green CI 839/840. Realm producer adoption, pending-operation completion and full guest builds remain open. See Kernel issue 7 for the exact native image and acceptance boundary.feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.b452a46803982c57e474adcc318ce40bd281d621; refresh component/dependency heads and their own CI evidence as implementation advances.Explicit install-grant library checkpoint — 19 September 2026: signed/pushed commit 5fc20dc5195383c42d0997038196686dba78a0c1. Checked staged construction and derivation now carry exact own grant rights separately from child installation ceilings. Four wire matrices pass 423 tests each and four syscall-shim matrices pass 20 each, with one existing raw-syscall ignore retained. Eight native builds and matching strict checks pass. Validation has no warnings. Original CI 367/368 passes with four complete hashed logs (500,618 bytes), zero warnings.
Coordinated actual consumers and matching native execution remain open under Kernel design 19. This dependency/wire checkpoint does not establish complete lifecycle acceptance or either full EriX build generation. Phase completion retains native external Rust/LLVM/runtime rebuilding as an independent requirement.
Acknowledged terminal accounting — 21 September 2026: Kernel design 20 specifies final scalar CPU evidence retained independently of native resource reclamation, repeatable observations bound to actual original observer generations, independent authorized observers, exact acknowledgement and claim release on observer death. Both ordinary and mediator consumers must commit terminal measurements and cleanup duties before acknowledgement, including consumer-loss handling.
Shared wire commit 0b889095fd04f6f4b1da1d4c0064150551f52122 is signed and pushed. Four wire configurations pass 427 tests each; four syscall-shim configurations pass 20 each with one existing ignore. Eight native builds, strict host/native Clippy, formatting, private rustdoc, Markdown and dependency checks pass without warnings. Native kernel and consumer adoption, actual CPL3/service VM acceptance and original CI observation remain open.
Canonical completion remains 3.48% weighted; 15 of 460 acceptance items. Full upstream Rust/LLVM/runtime rebuilding inside EriX remains mandatory together with both full EriX guest build generations. No acceptance item closes from this representation checkpoint.
Terminal-codec original CI — 21 September 2026: signed/pushed commit 0b889095fd04f6f4b1da1d4c0064150551f52122. Four wire configurations pass 427 tests each; four syscall-shim configurations pass 20 each with one existing ignore. Eight native builds and matching strict checks pass. Local validation is warning-free. Original CI 369/370 passes from four complete hashed logs (507,354 bytes), zero warnings.
Native producer and actual consumer adoption remains in progress under Kernel design 20. Runtime acceptance remains open; phase completion retains native upstream toolchain rebuilding and both EriX guest generations.
[FEATURE] [P02.R48] Audit authority, code quality and documentation in lib-ipcto [FEATURE] Audit authority, code quality and documentation in lib-ipc