erix/loaderd

Watch

Fork 0

generated from erix/meta

[FEATURE] Audit authority, code quality and documentation in loaderd #1

New issue

Open

opened 2026-09-12 07:57:56 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:57:56 +02:00

Owner

Problem and motivation

This issue tracks continuous Phase 6 audit closure for loaderd. Authenticate executable source graphs and coordinate link/materialization requests and launch results for authorized callers.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Staged mediator handoff contract — 15 September 2026

Reserve Loaderd operation 0x654 (PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class 0x448 (REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation 0x652 keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted.

Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop.

Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate.

This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance.

Current inventory: 1 Cargo target (1 bin); manifests: Cargo.toml. Include explicit and automatically discovered targets, supported features and target-specific configurations.

Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Staged mediator source checkpoint — 15 September 2026: Signed Loaderd adefd028c47d0e60bde65ef2ff2d95c8bfae11b6, Launchd 64b563482c9ecab115283fe56c8562d948fbbabd and Procd cdb0fe4d1496073521626ce21f0fa2c95a81bd36 implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC 5fa5fdb2edbfe963efae1c11f99a3a58d0062509 and capability ABI e5a3e864491479981b9ab37749109dafe52fa330 plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately.

Native bootstrap destination correction — 15 September 2026

The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in capability ABI bug #3. Capability ABI c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5 corrects the constant; Kernel b98156427362a468ae78195a3582901e2474fea5 adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored.

Corrected native staging checkpoint — 15 September 2026: Signed source b48365030459f854c9e36f3c14b654e9bb3535d8 is recorded in the current review. Stage an unstarted mediator through the authenticated complete executable graph, transferring only the actual install grant. 90 tests, both complete-graph producer classes, strict host/native checks and native binaries pass. CI 89/90 passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Native final mapping design — 15 September 2026:

Implement validated RELRO final permissions within the existing native materialization protocol. Loaderd retains authenticated original ELF bytes and original PT_LOAD relocation ranges for Dynlinkd. It separately derives page-bounded final materialization fragments, clearing WRITE on the complete declared protected region. Procd's existing transaction remains the sole owner of privileged construction writes and final mappings; no new control endpoint, capability, lookup root or wire operation is introduced. The child remains unstarted until all bytes and authoritative relocation writes succeed.

Validate range arithmetic, mapped coverage and every writable byte sharing a protected hardware page before starting a transaction. Rounded protection must neither leave a declared byte writable nor silently remove write permission from unrelated mutable data. Permit multiple checked regions without a fixed region-count cap and preserve normal images that declare none. Preserve exact file/BSS coverage, load bias, initial writable stack selection, relocation authorization, abort precedence and uncertain-cleanup behavior. Final fragment counting uses checked arithmetic and caller-owned source bytes, without an additional persistent table.

Independent tests will cover partial and complete segments, page sharing, adjacent/multiple regions, missing mappings, overflow and mutable-page conflicts. Transaction tests must preserve original relocation ranges while emitting final read-only permissions, apply construction relocations successfully and retain failure/abort behavior. Run strict host/native Rust matrices, the complete existing tests, relevant native VM checks and warning-free manual/CI validation. This establishes final mapping permissions only; typed grant custody, whole-codebase authority closure, exact native frame proof and both complete guest builds remain separate requirements.

Specification provenance: the LSB program-header definition and GNU linker options describe the relocation-protected region and hardware page-size constraint. The implementation and fixtures will be original; no external implementation is copied.

Native RELRO checkpoint — 16 September 2026: signed ec353c90590b8b5529f34b43e48b61789c3ac70e validates protected ranges before effects and derives final read-only child mappings independently of original relocation authorization. Fifteen new independent ELF/handoff controls bring the suite to 105 tests in each of six configurations. Strict host/native Clippy, six native builds, formatting, private rustdoc and canonical Markdown checks pass without warnings. Static replay admits all 34 selected native dynamic artifacts. Existing construction writes, exact counts, authenticated bytes, writable initial stack and failure/abort semantics are retained. Matching native VM, complete current-head CI and the manual update are pending; full frame, realm and guest-build gates stay open.

Native RELRO manual — 16 September 2026: signed Docs 2560e70884ddcb1b2f262ef74ea0dd30084d4259 documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance.

Native permission checkpoint — 16 September 2026: signed Kernel 32c70109fe7663440aa56de6a49975accc1f0057 carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings.

Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is 8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812.

Signed Docs d221e725c2543316680e63fc5e8314ce0fe3bdf1 documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open.

Maintained permission regression — 16 September 2026: signed Integration 89d15e4536004c087dcebd63c87216c0fd58958d supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure.

Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination.

The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs 3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. Matching Docs CI 893/894 passes with all four complete logs (762,616 bytes) and zero final warnings. Current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open.

Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph.

On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant.

Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work.

Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain.

Original supervisor service checkpoint — 18 September 2026: Signed 4f1fb6371d46740ab2d637235f69e3fc604b3318 is pushed. Attest the actual native pending caller on private executable preparation and forward that original supervisor in the exact 64-byte materialization begin. Ordinary roles require zeros. Split the native preparation handler into a focused module. Three new boundary controls and all 108 tests pass in six strict host/native configurations, including production mode and six native builds. Formatting, strict Clippy, private rustdoc and Markdown pass without warnings. Original CI 95 and CI 96 passes with all four terminal logs (110,466 bytes), without warnings. Actual Launchd owned producer/runtime adoption, coordinated consumer VM execution, complete fairness, configuration/readiness/seal and both full guest builds remain open.

Coherent realm image service prerequisites — 18 September 2026: Signed 6783df35e4fae8c01ff3d281f0ec9d047892e986 selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 6 default, all-feature and separate production development/release configurations pass 108 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. The original push/PR CI observation and subsequent user-rerun disposition are recorded below. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open.

Resolved by user-triggered reruns, verified 19 September 2026: CI 97 (attempt 1), CI 98 (attempt 2), pass at unchanged commit 6783df35e4fae8c01ff3d281f0ec9d047892e986. All four test/Markdown job logs are complete and hashed (110,409 bytes), with zero warning or failure candidates. This resolves the current validation blockage. Original failed-attempt status and HTTP 500 observations remain history; their missing output and causes are not recovered or explained by this result. No source fix is claimed. Bug 3 is closed.

Historical original CI log evidence gap — 19 September 2026: Failed original jobs return HTTP 500 for their logs; bug 3 retains the selected run/job identities. Available original test logs pass without warnings, but the missing terminal output prevents complete CI acceptance or source-level diagnosis. At that observation no workflow had been rerun or cancelled.

Tracking and rollout

Runtime consumer dependency alignment — 15 September 2026

Signed 0012b9e35a155b4b2608ebcb5ab221586e909cba aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 90 default / 90 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: loaderd-runtime: 90 development / 90 release tests. There are 6 supported native builds in total. Push/review CI 91/92 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: #2.

Parent work: erix/integration#2 and erix/docs#1.
Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
Baseline revision: 9960bee61b4731a7bc4b0585cccc04c5ea03c0cc; refresh component/dependency heads and their own CI evidence as implementation advances.
Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

Verified grant-rights checkpoint — 20 September 2026:

Signed commit cdf08f8e5f2cf208390099598f86ccfaa7cc96eb requires exact GRANT-only final installer receipts and selects the original shared dependency graph. Four strict 108-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting and private rustdoc pass without warnings. Original CI 99/100 passes from four complete hashed logs (110,360 bytes), with zero warning candidates.

Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build.

Full coordinated consumer acceptance remains open under Kernel design 19 and phase completion.

Acknowledged terminal service dependencies — 21 September 2026: signed 2222a30dff752f9b8d9966471f41da10199ee91e selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under Kernel design 20. All 4 strict 108-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI 101, 102 passes; complete hashed logs total 110,460 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in Phase 6 completion.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `loaderd`. Authenticate executable source graphs and coordinate link/materialization requests and launch results for authorized callers. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope ### Staged mediator handoff contract — 15 September 2026 Reserve Loaderd operation `0x654` (PREPARE_REALM) using the existing exact-executable preparation request/response layout. The operation selects the new Procd lifecycle class `0x448` (REALM_MEDIATOR); role values describe lifecycle policy and confer no capability authority. Launchd explicitly selects this operation after authenticating its executable object. The ordinary operation `0x652` keeps its existing behavior. Responses must echo the selected operation; no fallback is permitted. Loaderd validates the same sole exact-executable SEND receipt, authenticates the complete image graph, and uses the existing semantic materialization pipeline. The mediator's temporary initial endpoint occupies child-local slot 4, after native root slots 1–3. This slot is an ABI destination, not a realm-count or resource-budget restriction. The child remains staged. Procd retains the actual endpoint master in the existing managed scratch endpoint column; it never exports that master to Loaderd or Launchd. Only the actual move-only install grant travels Procd → Loaderd → Launchd. The derived ordinary stream installer is absent for this class. Reply loss aborts the exact stage and accounts for the retained endpoint, grant and VSpace; cleanup uncertainty remains fail-stop. Launchd may inspect, abort and stop only its owned lifecycle classes. Root, driver and powerbox routes cannot use the mediator class; generic staged-start, ordinary startup/stream installation and automatic restart reject it. The future separate bootstrap transaction must receive the actual grant back, authenticate the live caller, install a typed receiver/rendezvous inventory using exact process-bound installation, dispose temporary aliases and configure the startup bytes before private execution. No existing start path may bypass that gate. This staged handoff is the first implementation increment of typed realm bootstrap. Acceptance for this increment requires malformed/foreign operation rejection, exact executable and grant receipts, unstarted materialization, private master retention, no derived stream grant, and rollback coverage across the actual producer paths. It does not establish mediator execution, seal, publication, client I/O, retirement fairness or either complete guest build generation. Those remain required under the existing acceptance criteria. Native VM coverage of the coordinated producer graph is required before claiming runtime acceptance. Current inventory: 1 Cargo target (1 bin); manifests: `Cargo.toml`. Include explicit and automatically discovered targets, supported features and target-specific configurations. Inventory every startup/runtime grant and authenticated peer, then success, denial, cancellation, failed transfer, restart and teardown. Trace callers and downstream providers so names, numeric identities and retained aliases never become implicit authority. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Staged mediator source checkpoint — 15 September 2026: Signed Loaderd `adefd028c47d0e60bde65ef2ff2d95c8bfae11b6`, Launchd `64b563482c9ecab115283fe56c8562d948fbbabd` and Procd `cdb0fe4d1496073521626ce21f0fa2c95a81bd36` implement separate exact-executable mediator staging. Operation 0x654 is correlated end-to-end; Procd retains the actual endpoint master and moves only the actual install grant. The mediator class cannot use ordinary start, immediate commit, TTY provisioning, powerbox installation or automatic restart. Exact-stage rollback and lost-reply custody remain owned. Shared IPC `5fa5fdb2edbfe963efae1c11f99a3a58d0062509` and capability ABI `e5a3e864491479981b9ab37749109dafe52fa330` plus six original helper commits form the coherent dependency graph. Default/all development and release matrices pass: IPC 371 plus shim 20 (one existing native-only host ignore), capability ABI 191, Loaderd 90, Launchd 326 and Procd 233/238 tests. Strict host/native Clippy, warning-denied freestanding builds, private rustdoc, formatting and Markdown checks pass. Procd has forty native binary builds and six new mediator refusal/cleanup regressions. Loaderd exercises both staging classes through the existing complete-graph producer test. The TTY transaction, its test support and lifecycle policy tests are split into files below 1,000 lines. All six aligned helper libraries pass their full matrices. Current shared IPC CI 341/342 and capability ABI 218/219 pass with all eight complete warning-free logs. Older full Integration 1615/1616 now passes all 486 scenarios and subsequent native probes with six complete classified logs; its three deliberate negative diagnostics per integration job are retained. New producer/helper review CI is pending. No Posixd executable or coordinated realm VM acceptance is claimed. Actual grant-return provisioning, authenticated caller ownership, typed startup memory/inventory, readiness, configuration/seal, client I/O, fair retirement, complete consumer image adoption and both full guest build generations remain open. The manual update is being validated separately. ### Native bootstrap destination correction — 15 September 2026 The temporary endpoint destination is now child-local slot 4, after the mandatory CSpace, VSpace and TCB roots in slots 1–3. The initial slot-1 contract was incorrect: the actual native constructor returned DENIED before creating a child. The original failure and published source identities are retained in [capability ABI bug #3](https://git.erikinkinen.fi/erix/lib-capabi/issues/3). Capability ABI `c7c72ae2a777b2a9f4ae5d7fb8eef86e5fc1fae5` corrects the constant; Kernel `b98156427362a468ae78195a3582901e2474fea5` adds an actual constructor regression and six CPL3 creation/cleanup calls. The expanded lifetime VM passes with ordered, unique staging and cleanup markers and empty QEMU stderr. This proves the constructor boundary; coordinated mediator startup, seal, client I/O, retirement and full guest builds remain open. Matching component CI is still being monitored. Corrected native staging checkpoint — 15 September 2026: Signed source `b48365030459f854c9e36f3c14b654e9bb3535d8` is recorded in [the current review](https://git.erikinkinen.fi/erix/loaderd/pulls/2). Stage an unstarted mediator through the authenticated complete executable graph, transferring only the actual install grant. 90 tests, both complete-graph producer classes, strict host/native checks and native binaries pass. CI 89/90 passes with complete warning-free logs. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. Native final mapping design — 15 September 2026: Implement validated RELRO final permissions within the existing native materialization protocol. Loaderd retains authenticated original ELF bytes and original PT_LOAD relocation ranges for Dynlinkd. It separately derives page-bounded final materialization fragments, clearing WRITE on the complete declared protected region. Procd's existing transaction remains the sole owner of privileged construction writes and final mappings; no new control endpoint, capability, lookup root or wire operation is introduced. The child remains unstarted until all bytes and authoritative relocation writes succeed. Validate range arithmetic, mapped coverage and every writable byte sharing a protected hardware page before starting a transaction. Rounded protection must neither leave a declared byte writable nor silently remove write permission from unrelated mutable data. Permit multiple checked regions without a fixed region-count cap and preserve normal images that declare none. Preserve exact file/BSS coverage, load bias, initial writable stack selection, relocation authorization, abort precedence and uncertain-cleanup behavior. Final fragment counting uses checked arithmetic and caller-owned source bytes, without an additional persistent table. Independent tests will cover partial and complete segments, page sharing, adjacent/multiple regions, missing mappings, overflow and mutable-page conflicts. Transaction tests must preserve original relocation ranges while emitting final read-only permissions, apply construction relocations successfully and retain failure/abort behavior. Run strict host/native Rust matrices, the complete existing tests, relevant native VM checks and warning-free manual/CI validation. This establishes final mapping permissions only; typed grant custody, whole-codebase authority closure, exact native frame proof and both complete guest builds remain separate requirements. Specification provenance: the [LSB program-header definition](https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/progheader.html) and [GNU linker options](https://sourceware.org/binutils/docs/ld/Options.html) describe the relocation-protected region and hardware page-size constraint. The implementation and fixtures will be original; no external implementation is copied. Native RELRO checkpoint — 16 September 2026: signed `ec353c90590b8b5529f34b43e48b61789c3ac70e` validates protected ranges before effects and derives final read-only child mappings independently of original relocation authorization. Fifteen new independent ELF/handoff controls bring the suite to 105 tests in each of six configurations. Strict host/native Clippy, six native builds, formatting, private rustdoc and canonical Markdown checks pass without warnings. Static replay admits all 34 selected native dynamic artifacts. Existing construction writes, exact counts, authenticated bytes, writable initial stack and failure/abort semantics are retained. Matching native VM, complete current-head CI and the manual update are pending; full frame, realm and guest-build gates stay open. Native RELRO manual — 16 September 2026: signed Docs `2560e70884ddcb1b2f262ef74ea0dd30084d4259` documents protected-page validation, exact final mapping fragments, the writable initial stack and privileged construction writes over an unstarted child. All 45 documentation tests and canonical checks pass. The complete manual has 2,375 pages and 434,088 in-bounds word boxes, with zero final warnings; both changed pages pass visual review. Exported API snapshots are unchanged. Loaderd CI 93/94 passes with all four complete classified logs (109,621 bytes) and zero warnings. Docs CI 889/890 passes with all four complete classified logs (762,216 bytes); both manual jobs pass 45 tests and converge with 35/1/0 reference warnings, leaving zero final warnings. The earlier diagnostic native command sequence passed while its permission observation failed; the subsequent repaired checkpoint below supersedes that scoped result. This checkpoint does not establish complete runtime permission, frame, authority, realm or guest-build acceptance. Native permission checkpoint — 16 September 2026: signed Kernel `32c70109fe7663440aa56de6a49975accc1f0057` carries explicit live execution permission through single-page, batch and permission-only mappings. Data and construction aliases remain non-executable; ancestor promotion and splitting preserve neighbouring restrictions. Processor activation validates and enables execute-disable support on the bootstrap and application processors. Seven independent controls accompany the repair. Strict default/all-feature development/release suites pass 666/690 kernel unit tests plus two external controls per selection, retaining three existing ignores. Host/native Clippy, private rustdoc, formatting and ten native builds pass without warnings. Separate one-CPU and two-CPU diagnostic VMs pass the unchanged native command sequence. A read-only hardware observer matches all 233,755 selected coreutils executable bytes, verifies CPL3 and enabled paging/execute-disable state, and confirms both observed RELRO pages are user-readable, read-only and non-executable; the current stack is user-writable and non-executable. Both processors report execute-disable enabled. This is an exact process-entry/table observation, not an injected instruction-fault test or whole-system permission proof. The diagnostic image SHA-256 is `8c3c24639e8e1ca8c4f2ad4e485323abf32ec07408241c3e4fa9713f6e07e812`. Signed Docs `d221e725c2543316680e63fc5e8314ce0fe3bdf1` documents the mapping and processor contracts. All 45 documentation tests and canonical checks pass; the 2,375-page manual has 434,308 in-bounds word boxes and zero final warnings, with three changed pages visually reviewed. Exported API snapshots are unchanged. Kernel CI 574/575 passes with four complete warning-free logs (708,112 bytes), including existing optimized workload examples. Docs CI 891/892 passes all four complete logs (762,176 bytes), with 45 tests per manual job and zero final warnings. The later maintained permission regression is recorded below. Full frame proof, whole-codebase authority/documentation review, runnable realms and both complete guest build generations remain open. Maintained permission regression — 16 September 2026: signed Integration `89d15e4536004c087dcebd63c87216c0fd58958d` supplies the explicit-input runner, pure ELF/page-table checks and read-only GDB observer. The final maintained source passes 21 independent host controls and the complete strict default/all-feature development/release Rust matrix, host/native Clippy, private rustdoc, formatting and four native builds. Canonical checks pass after correcting one Markdown line wrap. Both host groups are wired into ordinary CI. All 2,995 inventoried authored code files are below 1,000 lines; this is physical size evidence, not semantic authority closure. Actual one-CPU and two-CPU runs on the repaired diagnostic image pass the original native-time command sequence and the expanded hardware checks: all 58 selected code pages are user-readable, read-only and executable; both RELRO pages are read-only/non-executable; the current stack is writable/non-executable. Complete executable bytes match and NX interpretation is enabled on every selected processor. An earlier image is rejected by the maintained observer. Both child outcomes, exact original input bytes and temporary cleanup are retained, with empty debugger stderr in both positive runs. The final cleanup code also preserves reaping when a direct child exits between poll and termination. The command's image CI gate awaits adoption of a coherent product catalog containing both required component fixes. Its explicit diagnostic invocations do not silently replace the older maintained image graph. Signed Docs `3fb0b12ff55d044cc4bbe142418ab7a5b07bb42d` documents the maintained operator contract. All 45 tests and canonical checks pass; the 2,377-page manual has 434,563 in-bounds word boxes with zero final warnings, and the changed subsection passes visual review. Exported API snapshots are unchanged. Matching Docs CI 893/894 passes with all four complete logs (762,616 bytes) and zero final warnings. Current Integration CI, complete frame proof, whole-codebase authority/documentation closure, runnable realms and both guest-build generations remain open. Original realm supervisor and producer cancellation contract — 18 September 2026: Extend BEGIN_MATERIALIZATION to an exact 64-byte body. Its existing 56-byte semantic image description is followed by two full-width u32 fields: original supervisor process ID and generation. Both are nonzero only for the realm mediator role; both must be zero for every other role. Reject the obsolete 56-byte shape. Coordinate the shared codec, Loaderd and Procd through one original pinned dependency graph. On PREPARE_REALM, Loaderd obtains the supervisor pair from the actual native pending caller on its private Launchd receiver. Procd authenticates the actual Loaderd caller on its materialization receiver and matches the forwarded supervisor to its retained Running Launchd generation before any child effect. The pair describes delegated lifecycle responsibility; numbers alone never confer creation, installation or rollback authority. Retain that original owner before materialization and through grant handoff, native submit/claim and guarded staging. Supervisor terminality retires active preparation and every corresponding stage before unrelated provider cleanup. Guard admission must match the original supervisor, never replace it with a later claimant. Launchd retains child rollback and native invocation ownership separately. Caller RELEASE initiates cancellation and must precede any ordinary abort request that could wait behind Procd delivery retirement. RELEASE is not an application rollback acknowledgment: preserve the exact child obligation until its separate cleanup proof. Procd exhausts independent local and child cleanup before server RELINQUISH. Both parties retain nonzero native IDs and the first cleanup failure through draining; no uncertain state returns to ordinary work. Actual Launchd runtime preparation and scheduler adoption, deployment-sized ownership storage, adversarial host controls and real producer/consumer VM execution remain required. Guarded staging does not authorize ordinary start or establish configuration, readiness, sealing, complete fairness or either full EriX build inside EriX. Existing source, effect and frame gates remain. Original supervisor service checkpoint — 18 September 2026: Signed `4f1fb6371d46740ab2d637235f69e3fc604b3318` is pushed. Attest the actual native pending caller on private executable preparation and forward that original supervisor in the exact 64-byte materialization begin. Ordinary roles require zeros. Split the native preparation handler into a focused module. Three new boundary controls and all 108 tests pass in six strict host/native configurations, including production mode and six native builds. Formatting, strict Clippy, private rustdoc and Markdown pass without warnings. Original [CI 95](https://git.erikinkinen.fi/erix/loaderd/actions/runs/95) and [CI 96](https://git.erikinkinen.fi/erix/loaderd/actions/runs/96) passes with all four terminal logs (110,466 bytes), without warnings. Actual Launchd owned producer/runtime adoption, coordinated consumer VM execution, complete fairness, configuration/readiness/seal and both full guest builds remain open. Coherent realm image service prerequisites — 18 September 2026: Signed `6783df35e4fae8c01ff3d281f0ec9d047892e986` selects the original shared wire/startup dependency graph. Direct Rust implementation bytes are unchanged. All 6 default, all-feature and separate production development/release configurations pass 108 unit tests per configuration, strict host/native Clippy and freestanding linking with fatal linker warnings. Formatting, private-item rustdoc and Markdown pass, with zero warnings. The original push/PR CI observation and subsequent user-rerun disposition are recorded below. Matching catalog adoption and real consumer VMs remain requirements; complete realm and full in-guest build acceptance remain open. Resolved by user-triggered reruns, verified 19 September 2026: [CI 97](https://git.erikinkinen.fi/erix/loaderd/actions/runs/97) (attempt 1), [CI 98](https://git.erikinkinen.fi/erix/loaderd/actions/runs/98) (attempt 2), pass at unchanged commit `6783df35e4fae8c01ff3d281f0ec9d047892e986`. All four test/Markdown job logs are complete and hashed (110,409 bytes), with zero warning or failure candidates. This resolves the current validation blockage. Original failed-attempt status and HTTP 500 observations remain history; their missing output and causes are not recovered or explained by this result. No source fix is claimed. [Bug 3](https://git.erikinkinen.fi/erix/loaderd/issues/3) is closed. Historical original CI log evidence gap — 19 September 2026: Failed original jobs return HTTP 500 for their logs; [bug 3](https://git.erikinkinen.fi/erix/loaderd/issues/3) retains the selected run/job identities. Available original test logs pass without warnings, but the missing terminal output prevents complete CI acceptance or source-level diagnosis. At that observation no workflow had been rerun or cancelled. ## Tracking and rollout ### Runtime consumer dependency alignment — 15 September 2026 Signed `0012b9e35a155b4b2608ebcb5ab221586e909cba` aligns the existing dependency selections with the original signed runtime graph. This checkpoint changes Cargo selections and the roadmap; this repository's Rust implementation files are unchanged. Formatting, strict Clippy, private rustdoc and canonical documentation checks pass without warnings. Default/all-feature development/release tests pass 90 default / 90 all-feature tests. Independent production configurations also pass strict host/native Clippy and native builds: `loaderd-runtime`: 90 development / 90 release tests. There are 6 supported native builds in total. Push/review CI 91/92 passes with complete classified logs and no final warnings. The product catalog, product VM acceptance and guest build remain pending. Review: https://git.erikinkinen.fi/erix/loaderd/pulls/2. - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `9960bee61b4731a7bc4b0585cccc04c5ea03c0cc`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images. Verified grant-rights checkpoint — 20 September 2026: Signed commit [cdf08f8e5f2cf208390099598f86ccfaa7cc96eb](https://git.erikinkinen.fi/erix/loaderd/commit/cdf08f8e5f2cf208390099598f86ccfaa7cc96eb) requires exact GRANT-only final installer receipts and selects the original shared dependency graph. Four strict 108-unit configurations, four native builds with the maintained linker layout, host/native Clippy, formatting and private rustdoc pass without warnings. Original CI 99/100 passes from four complete hashed logs (110,360 bytes), with zero warning candidates. Both maintained isolated native scenarios pass on their first attempts under the unchanged 60-second scenario limits, with no build warnings and empty QEMU stderr. Lifetime now exercises 27 ordinary CPL3 grant-right controls and requires INSTALL_GRANT_RIGHTS_OK before its existing cleanup assertions. Its 2,025-byte serial stream has SHA256 `6c685f1ceaf9080bf0bec628a4fac512bf9049d0fbcfe2b3737666adf414ca3a`; owned invocation retains 1,587 bytes. Normal stripping exactly matches both packaged kernels to retained original artifacts. All fifteen selected original source signatures and clean trees verify. These minimal native scenarios establish neither full service-image acceptance nor a guest build. Full coordinated consumer acceptance remains open under [Kernel design 19](https://git.erikinkinen.fi/erix/kernel/issues/19) and [phase completion](https://git.erikinkinen.fi/erix/integration/issues/65). Acknowledged terminal service dependencies — 21 September 2026: signed [2222a30dff752f9b8d9966471f41da10199ee91e](https://git.erikinkinen.fi/erix/loaderd/commit/2222a30dff752f9b8d9966471f41da10199ee91e) selects the original shared libraries for repeated terminal observation, exact acknowledgement and final CPU measurements under [Kernel design 20](https://git.erikinkinen.fi/erix/kernel/issues/20). All 4 strict 108-test selected development/release feature configurations, warning-denied host/native builds with the maintained linker layout, host/native Clippy, private rustdoc, applicable doctests, formatting and dependency/Markdown checks pass. All authored code remains below 1,000 lines. Original CI [101](https://git.erikinkinen.fi/erix/loaderd/actions/runs/101), [102](https://git.erikinkinen.fi/erix/loaderd/actions/runs/102) passes; complete hashed logs total 110,460 bytes with zero warning candidates. Full service CPU/profiler VM acceptance and guest builds remain open in [Phase 6 completion](https://git.erikinkinen.fi/erix/integration/issues/65).

erikinkinen added the

labels

2026-09-12 07:57:56 +02:00

erikinkinen referenced this issue from erix/integration

2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from ~~[FEATURE] [P02.R57] Audit authority, code quality and documentation in loaderd~~ to [FEATURE] Audit authority, code quality and documentation in loaderd

2026-09-12 08:02:34 +02:00

erikinkinen referenced this issue

2026-09-15 10:56:15 +02:00

WIP: Enforce native RELRO and stage exact realm mediators #2

erikinkinen referenced this issue

2026-09-19 11:03:54 +02:00

[BUG] Failed original CI jobs return HTTP 500 for logs #3

erikinkinen referenced this issue from erix/integration

2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65