EriX Pager Service (pagerd)

pagerd is the user-space paging/backing policy service. It provides page content and page-fault resolution policy for managed mappings.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX pager service daemon. Its purpose in EriX is to provide the pager service role through explicit IPC and startup authority.

Functionally, it implements the daemon runtime, state model, IPC handling, and validation tests. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• implement the pager service runtime and state model
• validate startup authority before accepting IPC requests
• handle bounded service operations through the assigned endpoint set
• keep service behavior, tests, and authority invariants documented

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Implementation Status

Runtime baseline:

• no_std executable service binary (x86_64-unknown-none) with SysV entry ABI
• startup envelope parsing/validation via lib-bootstrap
• role/intake contract validation via lib-capabi
• runtime IPC server loop (RECV + REPLY) for pager fault/resolve messages
• framed runtime CALL messages are classified before raw fault notifications, so procd vspace registration calls cannot be consumed as one-way fault events
• primary control slot is the dedicated pager/fault endpoint SLOT_KERNEL_PAGER_ENDPOINT (2256)
• image-backed fault resolution now uses an explicit pagerd-local image-frame slot seeded by rootd, not the canonical boot-module-table slot
• pagerd now maps that shared image backing only inside the per-process image range explicitly registered by procd; faults outside that range fall back to anonymous demand-zero allocation
• process-vspace registration is bounded to 128 explicit child VSPACE bindings, matching the current procd managed-process window for the Phase 5 dynamic service wave
• optional startup logging submits Rust strings through lib-log and checks the logical LogSubmitResponseV1::is_success() result while delegating chunk framing, request sequencing, and submit buffer sizing to the logging client library
• deterministic fault-id tracking and resolve response policy

Authority cleanup status:

• pagerd now accepts explicit register/unregister process-vspace requests from procd
• process-vspace registration remains a framed CALL path and raw fault notifications are accepted only in the unframed fixed-size fault-notify shape
• runtime fault resolution maps through the registered delegated VSPACE cap, not by treating process_id as ambient VSPACE authority
• downstream phase0 vspaced map requests now send reserved0 = 0 instead of compatibility process metadata
• both the image-backed and anonymous-fallback runtime map paths reuse that same zero-reserved request shape; pagerd does not widen authority by reintroducing compatibility metadata on fallback faults
• the registration contract now includes image-backed virtual-address bounds so pagerd can keep anonymous faults isolated across processes that share the same boot image frame source
• the registered process-vspace table is capacity-bound and consumes only the delegated child VSPACE aliases supplied by procd; it does not infer VSPACE authority from process identifiers or slot conventions
• anonymous fallback frames are counted against the registered process binding and reclaimed through memd when procd unregisters the process VSpace, so dynamic Phase 0 helper faults do not leave residual frame authority

Dynamic Boot Artifact Evidence

Phase 5.4.37 documents pagerd as a dynamic boot artifact. The image build packages the pager service as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd/kernel process-control before procd is available; authority remains the explicit pager endpoint and startup transfer set. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service-discovery, provider-bypass, block-device, or dynlinkd authority. pagerd receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

pagerd governance is scoped to pager service behavior and fault-response policy.

The scoped governance rules are:

• It responds only to paging authority assigned by startup contracts.
• It keeps fault handling deterministic and bounded by process memory policy.
• It validates page requests before mapping or backing memory.
• It does not receive unrelated device, filesystem, or service-discovery authority.

Authority Boundaries

• pagerd operates only through startup-assigned service capabilities.
• New authority must be represented in bootstrap/capability validation and integration tests before use.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.