WIP: Specify staged mediator custody and realm bootstrap ownership #5

Draft
erikinkinen wants to merge 10 commits from feature/posix-compat into main
Owner

Summary and rationale

Document private mediator custody, staged handoff and the remaining typed bootstrap, seal and retirement contract. This repository has no runtime crate.

Tracking and scope

Owning feature issue #1 and realm design. Signed checkpoint: a174994ac6ebe5561f6bc1095cb3abcb3ec71d91. The corrected native slot collision is tracked in capability ABI issue 3.

Architecture, authority and failure behavior

The producer authenticates the actual executable and exact install-grant receipt. Procd owns the endpoint master; the mediator remains unstarted. Numeric operations, lifecycle classes, paths and slots confer no authority. The temporary endpoint uses slot 4 after native roots 1–3. Broader failure-path coverage and all typed startup gates remain open.

Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.

Validation evidence

Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision 2aefcaa7b2d847a6982d5d24fefac89a536e6bf8 is pushed. The architecture and roadmap record the exact-generation cleanup prerequisite and native test scope. Markdown and document-template checks pass, as do original CI 15/16 with both complete logs (7,232 bytes), without warnings. This repository remains a design specification: Rust and Posixd runtime VM tests are not applicable to this documentation-only checkpoint. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open.

Coordinated terminal observation checkpoint — 17 September 2026: Signed revision 60fb8a3a7ad685d4378ca4299b9c7fbf9809c3d4 is pushed. The realm ownership documentation adopts the checked native generation prerequisite. Canonical headings, governance identity, Markdown and whitespace pass. This repository still contains no Cargo crate or executable service; local Rust tests are not applicable. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.

Older CI disposition — 15 September 2026: Previous review run 10 failed and its terminal log endpoint returned HTTP 500 on two spaced checks. CI issue 6 tracks the missing evidence and unknown cause. Current signed source passes both CI 11/12 with complete warning-free logs.

Markdown, template-heading, governance-identity and whitespace checks pass. Rust/native checks do not apply to this documentation-only repository. Push CI 11 and review CI 12 pass with complete warning-free logs.

Formatting and applicable warning-denied builds pass. No new guest-performance result is claimed. Current inventory covers 76 repositories and 2958 code files below 1000 lines, with direct missing_docs gates on 158 Rust roots; semantic and private-item documentation closure remain open.

Review checklist

  • Document the concrete staging contract and exact custody.
  • Validate applicable unit, native, documentation and formatting checks.
  • Publish signed canonical source checkpoints with original dependency pins.
  • Complete every outstanding dependent CI and runtime acceptance gate.
  • Finish typed mediator startup, isolation and retirement.
  • Complete whole-codebase audits and both full guest build generations.

Guarded-custody documentation reconciliation — 19 September 2026: signed Posixd PR 5, 9b031a8c2f996491a322046a4f2acd5dacdc55c2, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable.

Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original Posixd CI 17 and 18 both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository.

Signed Docs PR 4, 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original Docs CI 977 and 978 are running. These documentation corrections add no runtime behavior; the previously retained Integration 78557a6c672ecf426dfe894a01cc4aeec73b5e3c appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required.

Original Docs CI 977/978 passes for signed 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result.

Minimum bootstrap design — 19 September 2026: signed Posixd proposal, in PR 5, specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate.

Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution.

The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original Posixd CI 19 and 20 pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added.

Native child-lifetime prerequisite — 19 September 2026: Kernel design #19 now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration a62d1381f56a01afc692112d9b427205eaeb6a2e. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.

## Summary and rationale Document private mediator custody, staged handoff and the remaining typed bootstrap, seal and retirement contract. This repository has no runtime crate. ## Tracking and scope Owning feature issue #1 and [realm design](https://git.erikinkinen.fi/erix/posixd/issues/1). Signed checkpoint: `a174994ac6ebe5561f6bc1095cb3abcb3ec71d91`. The corrected native slot collision is tracked in [capability ABI issue 3](https://git.erikinkinen.fi/erix/lib-capabi/issues/3). ## Architecture, authority and failure behavior The producer authenticates the actual executable and exact install-grant receipt. Procd owns the endpoint master; the mediator remains unstarted. Numeric operations, lifecycle classes, paths and slots confer no authority. The temporary endpoint uses slot 4 after native roots 1–3. Broader failure-path coverage and all typed startup gates remain open. Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed. ## Validation evidence Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision `2aefcaa7b2d847a6982d5d24fefac89a536e6bf8` is pushed. The architecture and roadmap record the exact-generation cleanup prerequisite and native test scope. Markdown and document-template checks pass, as do original CI 15/16 with both complete logs (7,232 bytes), without warnings. This repository remains a design specification: Rust and Posixd runtime VM tests are not applicable to this documentation-only checkpoint. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open. Coordinated terminal observation checkpoint — 17 September 2026: Signed revision `60fb8a3a7ad685d4378ca4299b9c7fbf9809c3d4` is pushed. The realm ownership documentation adopts the checked native generation prerequisite. Canonical headings, governance identity, Markdown and whitespace pass. This repository still contains no Cargo crate or executable service; local Rust tests are not applicable. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open. Older CI disposition — 15 September 2026: Previous review run 10 failed and its terminal log endpoint returned HTTP 500 on two spaced checks. [CI issue 6](https://git.erikinkinen.fi/erix/posixd/issues/6) tracks the missing evidence and unknown cause. Current signed source passes both CI 11/12 with complete warning-free logs. Markdown, template-heading, governance-identity and whitespace checks pass. Rust/native checks do not apply to this documentation-only repository. Push CI 11 and review CI 12 pass with complete warning-free logs. Formatting and applicable warning-denied builds pass. No new guest-performance result is claimed. Current inventory covers 76 repositories and 2958 code files below 1000 lines, with direct missing_docs gates on 158 Rust roots; semantic and private-item documentation closure remain open. ## Review checklist - [x] Document the concrete staging contract and exact custody. - [x] Validate applicable unit, native, documentation and formatting checks. - [x] Publish signed canonical source checkpoints with original dependency pins. - [ ] Complete every outstanding dependent CI and runtime acceptance gate. - [ ] Finish typed mediator startup, isolation and retirement. - [ ] Complete whole-codebase audits and both full guest build generations. Guarded-custody documentation reconciliation — 19 September 2026: signed [Posixd PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5), `9b031a8c2f996491a322046a4f2acd5dacdc55c2`, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable. Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original [Posixd CI 17](https://git.erikinkinen.fi/erix/posixd/actions/runs/17) and [18](https://git.erikinkinen.fi/erix/posixd/actions/runs/18) both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository. Signed [Docs PR 4](https://git.erikinkinen.fi/erix/docs/pulls/4), `7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d`, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original [Docs CI 977](https://git.erikinkinen.fi/erix/docs/actions/runs/977) and [978](https://git.erikinkinen.fi/erix/docs/actions/runs/978) are running. These documentation corrections add no runtime behavior; the previously retained Integration `78557a6c672ecf426dfe894a01cc4aeec73b5e3c` appliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required. Original Docs CI 977/978 passes for signed 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result. Minimum bootstrap design — 19 September 2026: signed [Posixd proposal](https://git.erikinkinen.fi/erix/posixd/src/commit/3e6292bd3e5c6a3e59dbae54124f8eea52141957/docs/minimum-bootstrap.md), in [PR 5](https://git.erikinkinen.fi/erix/posixd/pulls/5), specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate. Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution. The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original [Posixd CI 19](https://git.erikinkinen.fi/erix/posixd/actions/runs/19) and [20](https://git.erikinkinen.fi/erix/posixd/actions/runs/20) pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added. Native child-lifetime prerequisite — 19 September 2026: [Kernel design #19](https://git.erikinkinen.fi/erix/kernel/issues/19) now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration `a62d1381f56a01afc692112d9b427205eaeb6a2e`. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.
docs: Define isolated realm ownership and bootstrap sequencing
All checks were successful
CI / markdown (push) Successful in 8s
CI / markdown (pull_request) Successful in 12s
91b18c9199
Replace inherited component-document placeholders with a Posixd ownership
contract. Select a separate native mediator process per realm, private client
receivers and explicit capability ceilings before introducing runtime effects.

Distinguish staged process installation, private mediator bootstrap and control
registration from sealed realm publication and client start. Record missing
producer and retirement contracts, including ownership that survives mediator
or supervisor loss. Keep numeric identities descriptive and unknown cleanup
unavailable for reuse.

Validate all Markdown, canonical document structure, local links and original
shared governance. No runtime, startup wire format or conformance is claimed.
docs: Specify guarded realm bootstrap and surviving custody
All checks were successful
CI / markdown (push) Successful in 14s
CI / markdown (pull_request) Successful in 14s
4f1a964cd3
Require actual SEND-branch revoker custody before exporting bootstrap routes.
Register final-process receiver readiness before releasing the guarded sender,
and configure through private pulls with capability-bearing owner replies.
Distinguish actual moved install-grant possession from staged-process records.

Keep Procd-held guards for mediator and Launchd loss separate from the ancestor
custody and independent trigger still needed for Procd loss. Product Rootd exits
after bootstrap; quarantine, alias absence, process destruction and operation
completion cannot replace one another. No runtime protocol or upstream holder
is assigned by this design correction.

Validation: all 10 Markdown files, canonical sections, six shared governance
files, 19 local links, source correlation and whitespace checks pass. These are
documentation-only changes; native tests and implementation remain pending.
The matching technical-manual update awaits its combined Docs render and CI.
docs: Select native ancestor custody for the planned realm producer
All checks were successful
CI / markdown (push) Successful in 6s
CI / markdown (pull_request) Successful in 6s
52ef820d33
Use the accepted Kernel lifetime mechanism for Procd's exact terminal
generation while retaining a separate nested guard for early retirement.
Require removal of bypass senders and setup masters before publication.
Keep receiver, child, provider and pending-operation ownership distinct;
this design choice implements no Posixd runtime or provisioning handshake.

Coordinate the proposed native request/result custody in Kernel issue 11.
The design leaves opcode, wire layout and escrow implementation unassigned.
Canonical Markdown, headings and governance pass. No Cargo crate is present.
docs: Reconcile native transport and realm producer prerequisites
All checks were successful
CI / markdown (pull_request) Successful in 5s
CI / markdown (push) Successful in 6s
3118b9008a
Record accepted Kernel lifetime custody and the immediate owned invocation
transport while keeping Posixd provisioning and runtime acceptance open.
Correct the stale upstream owner and wire implementation status. Identify
the existing blocking Procd receive/provider paths that require a separate
terminal-intake and owned cleanup schedule before publishing a usable realm.

Validation: Markdown, canonical document headings and governance bytes,
local links and whitespace checks. No executable, crate, ABI or producer
behavior changes; runtime tests and image builds are not applicable here.
The technical manual already distinguishes the accepted native mechanism
from the unimplemented realm producer and retirement contracts.
erikinkinen changed title from WIP: Specify isolated POSIX realm ownership and bootstrap to WIP: Specify realm bootstrap and native retirement ownership 2026-09-15 09:10:20 +02:00
docs: Specify grant custody during mediator staging
Some checks failed
CI / markdown (push) Successful in 11s
CI / markdown (pull_request) Failing after 1h0m56s
16262cf5c3
Define the separate exact-executable operation and lifecycle class, the
private endpoint master, grant-only handoff and ordinary-start gates. Keep
actual typed bootstrap execution, sealing, publication and client acceptance
explicitly open instead of treating a staged process as a running realm.

Markdown, canonical template headings, governance identity and whitespace
checks pass. This repository still contains no executable Rust service.
erikinkinen changed title from WIP: Specify realm bootstrap and native retirement ownership to WIP: Specify staged mediator custody and realm bootstrap ownership 2026-09-15 10:56:24 +02:00
docs: Correct the native mediator bootstrap destination
All checks were successful
CI / markdown (push) Successful in 8s
CI / markdown (pull_request) Successful in 7s
a174994ac6
Place the staged endpoint in slot 4 after the mandatory native CSpace,
VSpace and TCB roots. Keep the complete grant handoff and private master
custody contract; the mediator remains unstarted pending typed provisioning.

Canonical template and Markdown checks pass. The repository has no runtime
crate yet; native construction is validated by Kernel and Integration.
docs: Bind realm retirement to original native terminal generations
All checks were successful
CI / markdown (pull_request) Successful in 4s
CI / markdown (push) Successful in 4s
60fb8a3a7a
Specify the shared operation 55 prerequisite and exact process/generation
matching before realm cleanup. Retire the old native event selector without
conveying process-control authority to the mediator. Keep typed bootstrap,
ordinary service-image adoption and complete guest builds explicitly open.

Canonical headings, governance identity, Markdown and whitespace checks pass.
This repository still defines no executable Rust service; unit and native
runtime checks here are not applicable.
docs: Specify generation-bound native cleanup prerequisites
All checks were successful
CI / markdown (push) Successful in 19s
CI / markdown (pull_request) Successful in 14s
2aefcaa7b2
Describe retained native cleanup identity and complete acknowledged disposal
before mediator bootstrap. Record the scoped upstream component and CPL3
evidence while keeping Rootd adoption and runnable realm acceptance explicit.
The contract adds no Posixd runtime, wire format or native process authority.

Markdown, canonical document headings, shared governance and whitespace checks
pass. Rust and VM execution are not applicable to this documentation-only tree.
docs: Reconcile guarded preparation and remaining bootstrap
All checks were successful
CI / markdown (push) Successful in 9s
CI / markdown (pull_request) Successful in 9s
9b031a8c2f
Replace stale grant-return and custody gaps with the implemented native
producer boundary. Document trusted pre-execution receiver attenuation,
retained actual install grant, Kernel ancestor custody, Procd nested guards
and exact staged abort. A mediator disposal report cannot establish absence
of bypass senders. Link original producer sources and the passing scoped VM.

Keep minimum startup, private execution, readiness, configuration, sealing,
client I/O, native toolchain rebuilding and both full EriX builds open. This
repository still contains no Posixd runtime. Markdown, canonical headings,
governance bytes, local links, original source anchors and whitespace pass.
Rust and new VM checks do not apply to this documentation-only change.
docs: Define minimum mediator bootstrap ownership
All checks were successful
CI / markdown (push) Successful in 11s
CI / markdown (pull_request) Successful in 11s
3e6292bd3e
Specify the proposed private configuration route, counted startup inventory,
native caller evidence and retained-endpoint readiness challenge. Distinguish
child-read-only startup memory from Procd's trusted memory-write authority,
and require running-child retirement before opening private execution.
Identify surviving child termination after Procd loss as an unresolved
prerequisite rather than treating SEND revocation as process destruction.

Allocate no wire format or opcode and introduce no runtime authority. Keep
configuration, sealing, client I/O, full frame proof, native toolchain rebuild
and both full EriX build generations open. Markdown, canonical headings,
governance, local links, original source anchors and whitespace pass.
Rust and VM checks do not apply to this documentation-only proposal.
All checks were successful
CI / markdown (push) Successful in 11s
CI / markdown (pull_request) Successful in 11s
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feature/posix-compat:feature/posix-compat
git switch feature/posix-compat

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feature/posix-compat
git switch feature/posix-compat
git rebase main
git switch main
git merge --ff-only feature/posix-compat
git switch feature/posix-compat
git rebase main
git switch main
git merge --no-ff feature/posix-compat
git switch main
git merge --squash feature/posix-compat
git switch main
git merge --ff-only feature/posix-compat
git switch main
git merge feature/posix-compat
git push origin main
Sign in to join this conversation.
No description provided.