EriX Memory Service (memd)

memd is the user-space memory policy service. It owns allocation policy decisions above kernel primitive object semantics.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX mem service daemon. Its purpose in EriX is to provide the mem service role through explicit IPC and startup authority.

Functionally, it implements the daemon runtime, state model, IPC handling, and validation tests. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• implement the mem service runtime and state model
• validate startup authority before accepting IPC requests
• handle bounded service operations through the assigned endpoint set
• keep service behavior, tests, and authority invariants documented

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Implementation Status

Runtime baseline:

• no_std executable service binary (x86_64-unknown-none) with SysV entry ABI
• startup envelope parsing/validation via lib-bootstrap
• role/intake contract validation via lib-capabi
• startup ready-state validates actual local slot type/rights with caller-local QUERY_LOCAL_CAP on bare metal and QUERY_CAP in host/test scaffolding
• the host/test QUERY_CAP fallback is cfg-scoped so runtime/release builds remain warning-free
• runtime untyped retype uses only the explicit startup-transferred local untyped slots; it no longer scans the canonical root untyped range
• runtime IPC server loop (RECV + REPLY) for alloc/free frame requests
• primary control slot is the dedicated memory endpoint SLOT_KERNEL_MEM_ENDPOINT (2224)
• deterministic in-service frame accounting and slot allocation
• newly retyped frame caps are allocated after the startup-reserved local transfer slots so runtime output does not overwrite the declared startup bundle
• frame accounting capacity follows the dedicated SLOT_MEMD_FRAME_ALLOC_* allocator window, with each exported frame retained until explicit free/drop
• optional startup logging submits Rust strings through lib-log and checks the logical LogSubmitResponseV1::is_success() result while delegating chunk framing, request sequencing, and submit buffer sizing to the logging client library

Dynamic Boot Artifact Evidence

Phase 5.4.37 documents memd as a dynamic boot artifact. The image build packages the memory manager service as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd/kernel process-control before procd is available; authority remains the explicit memory-control endpoint and startup transfer set. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service- discovery, provider-bypass, block-device, or dynlinkd authority. memd receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

memd governance is scoped to memory service policy above kernel allocation mechanisms.

The scoped governance rules are:

• It mediates only the memory authority assigned at startup.
• It keeps allocation and mapping requests bounded by explicit caller authority.
• It preserves kernel policy separation by implementing user-space memory service behavior.
• It rejects malformed or overbroad memory requests fail-closed.

Authority Boundaries

• memd operates only through startup-assigned service capabilities.
• New authority must be represented in bootstrap/capability validation and integration tests before use.
• Runtime frame free requests reclaim the allocator's own frame cap before a record becomes reusable; the pagerd anonymous-frame import slot is accepted only as the documented reclaim alias for outstanding pager allocations.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.