[FEATURE] Audit authority, code quality and documentation in posixd #4

New issue

Open

opened 2026-09-12 07:58:05 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-12 07:58:05 +02:00

Owner

Problem and motivation

This issue tracks continuous Phase 6 audit closure for posixd. Implement the planned per-realm POSIX compatibility mediator for descriptors, processes, credentials and signals within native authority ceilings.

An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance.

Proposed behavior and scope

Current targets: none; scaffolded from meta. Add every future library, executable, build script, example and test target to this audit before implementation acceptance.

The repository currently contains the verified meta template and no Rust implementation. Audit the scaffold now, then every implemented compatibility boundary; absence of a current target does not close future implementation rows.

Authority, security and reliability

Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption.

Acceptance criteria

Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value.
Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake.
Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented.
Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes.
Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary.
Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for.
Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical.
Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers.
Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant.
Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation.
Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits.
Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring.
Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads.
Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration.
Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result.
Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary.
Use maintained integration#3 profiler evidence before optimizing; preserve live access checks, ownership and success criteria.
Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies.
meaningful public/private inline documentation, crate/target missing_docs enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate.
Validation: Run cargo fmt --all -- --check, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads.
Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta.
Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass.

Alternatives and tradeoffs

Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed.

Validation checkpoint — 14 September 2026: Signed Posixd 52ef820d33399490c121aad3af1409139e4a8f44 selects the proposed realm custody owner: Procd deposits an ancestor SEND-lineage revoker into its exact native generation before export and retains a nested guard for earlier realm retirement. Exported aliases descend from the nested guard; ancestor-only bypass and setup aliases must be removed before publication. Kernel supplies the existing terminal trigger; children, provider leases, receiver aliases and pending operations retain separate owners and acknowledgments. This is a documented design; Posixd has no executable crate or implemented realm handshake. Posixd CI 5 and 6 pass with complete warning-free logs. Signed Docs d9bb106b94deb7c2af620775dc98be0cc46ae704 updates the process-services manual and records the separate owned invocation design. All 45 Docs tests and 55 Markdown files pass. The 2,341-page local manual has zero final warnings; 426,812 word boxes fit page bounds and the changed page was visually reviewed. Docs CI 849 and 850 pass; their manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. All six complete Posixd/Docs job logs total 760,808 bytes. Runtime producer adoption, realm byte I/O and both complete guest build generations remain open.

Owned invocation wire and native acceptance — 15 September 2026: Signed Posixd 3118b9008a85977b48babc342ba0587ddc99dd57 corrects stale upstream status and records producer adoption prerequisites. Kernel lifetime custody now supplies the surviving ancestor holder and actual Procd-terminal trigger, while the distinct nested producer revoker and complete realm cleanup are unimplemented. The shared immediate owned invocation wire/shim and Kernel adapter pass strict validation, component CI and an actual three-process CPL3 scenario covering all eight operations, including draining release and exact acknowledgment; the older lifetime VM also passes. Posixd still has no crate, executable or assigned startup/provisioning protocol. Current Procd intake can block on legacy transfer rendezvous and synchronous provider calls. Merely adding a realm table cannot establish bounded cleanup progress: the implementation must separately own and schedule native terminal intake, SEND-branch retirement and provider completion, retain actual moved install/guard custody, authenticate exact generation-bound readiness/configuration, dispose setup authority and only then seal. Native alias absence, process destruction and application completion remain distinct. Markdown, canonical headings/governance bytes, local links and whitespace pass for this documentation-only correction; Rust/image tests are not applicable to this repository change. Matching technical-manual realm prerequisites and the accepted syscall chapter remain current. Posixd CI 7/8 succeeds; both complete Markdown logs total 7,244 bytes with no warnings. This completed cohort is stopped. Two realms with two clients each performing mediated byte I/O, broader failure/reuse evidence, full audits and both complete EriX-in-EriX build generations remain open.

Tracking and rollout

Parent work: erix/integration#2 and erix/docs#1.
Branch: feature/posix-compat; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages.
Baseline revision: 3e301e4ac9c6c38fac34f987d63701fc11855086; refresh component/dependency heads and their own CI evidence as implementation advances.
Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

## Problem and motivation This issue tracks continuous Phase 6 audit closure for `posixd`. Implement the planned per-realm POSIX compatibility mediator for descriptors, processes, credentials and signals within native authority ceilings. An initial inventory is not a security or documentation closure claim. Evidence must follow each changed boundary through final heads, with priority security, reliability, then performance. ## Proposed behavior and scope Current targets: none; scaffolded from meta. Add every future library, executable, build script, example and test target to this audit before implementation acceptance. The repository currently contains the verified meta template and no Rust implementation. Audit the scaffold now, then every implemented compatibility boundary; absence of a current target does not close future implementation rows. ## Authority, security and reliability Maintain a finding register with public finding references, exact revisions, invariants, reproduction, owners, regression tests and closure evidence. Publish only non-sensitive status here; suspected vulnerabilities follow SECURITY.md. Each dimension below needs its own result and rationale; an absent daemon or current Rust target is not a blanket exemption. ## Acceptance criteria - [ ] Record origin, recipient, object, operations, delegation ceiling, lifetime and aliases for each relevant capability or caller-supplied authority-bearing value. - [ ] Audit ambient discovery/selectors, cwd/PATH/environment, numeric identities, inherited routes and host fallbacks; require explicit authorized intake. - [ ] Account for residual authority after success, error, cancellation, timeout, restart, failed transfer and teardown, including fork/exec where implemented. - [ ] Remove unnecessary endpoints, broad rights, duplicate aliases, provider/admin grants and debug routes. - [ ] Exercise stale generations, replay, pending replies, forged descriptive identity and object/path resolution races at the owned boundary. - [ ] Prove independent cleanup attempts and caller-specific error precedence; quarantine or terminate when retained authority cannot be accounted for. - [ ] Review unsafe/FFI/parser/arithmetic/lifetime/lock/publication invariants and add adversarial coverage where practical. - [ ] Inventory obsolete APIs, wrappers, fallback/dead paths and duplicate validators with their maintained callers. - [ ] Migrate callers and delete deprecated contracts/shims in a coherent signed revision graph; reject retired input versions where relevant. - [ ] Classify each size/count/depth/time bound as ABI, hardware, explicit resource policy or accidental limitation. - [ ] Test beyond removed boundaries and at allocation/ABI limits while preserving exhaustion errors, denial-of-service controls and bounded waits. - [ ] Keep every tracked authored code/test/script/workflow file below 1000 physical lines through thematic refactoring. - [ ] Run the deterministic tracked-source size gate, covering executable fixtures/generators and excluding only genuine non-code data or external payloads. - [ ] Audit production/test feature and symbol separation, including this repository's effect on rootd test orchestration. - [ ] Supply changes affecting rootd semantic surface to the maintained same-toolchain baseline; record a justified component-specific applicability result. - [ ] Check bootstrap ownership and development/release authority parity at this repository's producer/consumer boundary. - [ ] Use maintained [integration#3](https://git.erikinkinen.fi/erix/integration/issues/3) profiler evidence before optimizing; preserve live access checks, ownership and success criteria. - [ ] Audit build/CI inputs, secret handling, private outputs, symlink containment, deletion, subprocess bounds, warnings and host dependencies. - [ ] meaningful public/private inline documentation, crate/target `missing_docs` enforcement without blanket allowances or hidden-API escapes, warning-denied private-item rustdoc and an undocumented-public-API negative gate. - [ ] Validation: Run `cargo fmt --all -- --check`, strict Clippy, unit/doctests and warning-denied builds/rustdoc for every owned crate/target under default and all valid feature, freestanding/host, SMP and profile combinations; test mutually exclusive combinations separately. Add focused VM regressions for runtime behavior and observe the older catalog and unit tests at the exact published heads. - [ ] Documentation: update applicable README/ARCHITECTURE/ROADMAP in meta's canonical format and affected technical-manual TeX/API references; keep README evergreen and shared governance byte-identical to meta. - [ ] Evidence: record exact source/dependency revisions, commands, configurations, real exit status, CI run URLs and results; repeat the audit on final heads and obtain independent review of security closures. No skipped/pending/predecessor result counts as a pass. ## Alternatives and tradeoffs Use cohesive local refactoring or a justified shared extraction only after identifying real common semantics and authority boundaries. Remove superseded paths after preserving maintained coverage. Profile before optimization; document unavoidable ABI/hardware limits and explicit quotas rather than weakening security for speed. Validation checkpoint — 14 September 2026: Signed Posixd `52ef820d33399490c121aad3af1409139e4a8f44` selects the proposed realm custody owner: Procd deposits an ancestor SEND-lineage revoker into its exact native generation before export and retains a nested guard for earlier realm retirement. Exported aliases descend from the nested guard; ancestor-only bypass and setup aliases must be removed before publication. Kernel supplies the existing terminal trigger; children, provider leases, receiver aliases and pending operations retain separate owners and acknowledgments. This is a documented design; Posixd has no executable crate or implemented realm handshake. Posixd CI [5](https://git.erikinkinen.fi/erix/posixd/actions/runs/5) and [6](https://git.erikinkinen.fi/erix/posixd/actions/runs/6) pass with complete warning-free logs. Signed Docs `d9bb106b94deb7c2af620775dc98be0cc46ae704` updates the process-services manual and records the separate [owned invocation design](https://git.erikinkinen.fi/erix/kernel/issues/11). All 45 Docs tests and 55 Markdown files pass. The 2,341-page local manual has zero final warnings; 426,812 word boxes fit page bounds and the changed page was visually reviewed. Docs CI [849](https://git.erikinkinen.fi/erix/docs/actions/runs/849) and [850](https://git.erikinkinen.fi/erix/docs/actions/runs/850) pass; their manual jobs converge through 2,327/2,341/2,341 pages and 32/1/0 reference warnings, with no final layout warning. All six complete Posixd/Docs job logs total 760,808 bytes. Runtime producer adoption, realm byte I/O and both complete guest build generations remain open. Owned invocation wire and native acceptance — 15 September 2026: Signed Posixd `3118b9008a85977b48babc342ba0587ddc99dd57` corrects stale upstream status and records producer adoption prerequisites. Kernel lifetime custody now supplies the surviving ancestor holder and actual Procd-terminal trigger, while the distinct nested producer revoker and complete realm cleanup are unimplemented. The shared immediate owned invocation wire/shim and Kernel adapter pass strict validation, component CI and an actual three-process CPL3 scenario covering all eight operations, including draining release and exact acknowledgment; the older lifetime VM also passes. Posixd still has no crate, executable or assigned startup/provisioning protocol. Current Procd intake can block on legacy transfer rendezvous and synchronous provider calls. Merely adding a realm table cannot establish bounded cleanup progress: the implementation must separately own and schedule native terminal intake, SEND-branch retirement and provider completion, retain actual moved install/guard custody, authenticate exact generation-bound readiness/configuration, dispose setup authority and only then seal. Native alias absence, process destruction and application completion remain distinct. Markdown, canonical headings/governance bytes, local links and whitespace pass for this documentation-only correction; Rust/image tests are not applicable to this repository change. Matching technical-manual realm prerequisites and the accepted syscall chapter remain current. Posixd CI 7/8 succeeds; both complete Markdown logs total 7,244 bytes with no warnings. This completed cohort is stopped. Two realms with two clients each performing mediated byte I/O, broader failure/reuse evidence, full audits and both complete EriX-in-EriX build generations remain open. ## Tracking and rollout - Parent work: https://git.erikinkinen.fi/erix/integration/issues/2 and https://git.erikinkinen.fi/erix/docs/issues/1. - Branch: `feature/posix-compat`; update linked WIP PRs after coherent signed checkpoints using canonical CONTRIBUTING.md messages. - Baseline revision: `3e301e4ac9c6c38fac34f987d63701fc11855086`; refresh component/dependency heads and their own CI evidence as implementation advances. - Cross-repository dependencies remain full lowercase commit hashes; update the selected graph deliberately. This issue does not authorize merges, release tags or replacement of published images.

erikinkinen added the

labels

2026-09-12 07:58:05 +02:00

erikinkinen referenced this issue from erix/integration

2026-09-12 08:02:00 +02:00

[FEATURE] Audit and refactor authority, lifecycle and code quality across every repository #2

erikinkinen changed title from ~~[FEATURE] [P02.R76] Audit authority, code quality and documentation in posixd~~ to [FEATURE] Audit authority, code quality and documentation in posixd

2026-09-12 08:02:43 +02:00

~~erikinkinen referenced this issue 2026-09-12 20:12:35 +02:00~~

WIP: Specify staged mediator custody and realm bootstrap ownership #5

erikinkinen referenced this issue from erix/integration

2026-09-19 11:36:52 +02:00

[FEATURE] Track Phase 6 POSIX compatibility and full EriX self-hosting #65