WIP: Specify staged mediator custody and realm bootstrap ownership #5
No reviewers
Labels
No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
erix/posixd!5
Loading…
Reference in a new issue
No description provided.
Delete branch "feature/posix-compat"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary and rationale
Document private mediator custody, staged handoff and the remaining typed bootstrap, seal and retirement contract. This repository has no runtime crate.
Tracking and scope
Owning feature issue #1 and realm design. Signed checkpoint:
a174994ac6ebe5561f6bc1095cb3abcb3ec71d91. The corrected native slot collision is tracked in capability ABI issue 3.Architecture, authority and failure behavior
The producer authenticates the actual executable and exact install-grant receipt. Procd owns the endpoint master; the mediator remains unstarted. Numeric operations, lifecycle classes, paths and slots confer no authority. The temporary endpoint uses slot 4 after native roots 1–3. Broader failure-path coverage and all typed startup gates remain open.
Actual grant-return provisioning, authenticated receiver readiness, configuration/seal, client I/O, fair retirement, whole-codebase authority/documentation closure and both complete guest build generations remain required. No runnable Posixd realm or guest-build acceptance is claimed.
Validation evidence
Generation-bound cleanup consumer acceptance — 18 September 2026: Signed revision
2aefcaa7b2d847a6982d5d24fefac89a536e6bf8is pushed. The architecture and roadmap record the exact-generation cleanup prerequisite and native test scope. Markdown and document-template checks pass, as do original CI 15/16 with both complete logs (7,232 bytes), without warnings. This repository remains a design specification: Rust and Posixd runtime VM tests are not applicable to this documentation-only checkpoint. Runnable mediator bootstrap, fair retirement and both complete builds inside EriX remain open.Coordinated terminal observation checkpoint — 17 September 2026: Signed revision
60fb8a3a7ad685d4378ca4299b9c7fbf9809c3d4is pushed. The realm ownership documentation adopts the checked native generation prerequisite. Canonical headings, governance identity, Markdown and whitespace pass. This repository still contains no Cargo crate or executable service; local Rust tests are not applicable. Typed mediator bootstrap, ordinary service-image adoption and both complete EriX builds inside EriX remain open.Older CI disposition — 15 September 2026: Previous review run 10 failed and its terminal log endpoint returned HTTP 500 on two spaced checks. CI issue 6 tracks the missing evidence and unknown cause. Current signed source passes both CI 11/12 with complete warning-free logs.
Markdown, template-heading, governance-identity and whitespace checks pass. Rust/native checks do not apply to this documentation-only repository. Push CI 11 and review CI 12 pass with complete warning-free logs.
Formatting and applicable warning-denied builds pass. No new guest-performance result is claimed. Current inventory covers 76 repositories and 2958 code files below 1000 lines, with direct missing_docs gates on 158 Rust roots; semantic and private-item documentation closure remain open.
Review checklist
Guarded-custody documentation reconciliation — 19 September 2026: signed Posixd PR 5,
9b031a8c2f996491a322046a4f2acd5dacdc55c2, replaces stale grant-return and proposed-custody gaps with the implemented producer boundary. Procd uses the actual returned grant to attenuate the initial endpoint to RECV before execution, removes bypass sources, and retains nested custody beneath Kernel lifetime custody. A later mediator disposal report cannot prove absence of bypass senders. Exact staged abort and the remaining counted startup, readiness, configuration, sealing, client I/O and running-realm retirement requirements are distinguished. This repository still has no Posixd executable.Markdown, canonical headings/governance, local links, original source anchors and whitespace checks pass. Original Posixd CI 17 and 18 both pass from two complete hashed logs totaling 7,232 bytes without warnings. Rust checks do not apply to this documentation-only repository.
Signed Docs PR 4,
7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d, removes the matching stale passages from the process-services manual. All 45 tests and the full 2,419-page manual pass. All 445,847 word boxes lie within page bounds; the actual changed paragraphs and continuation on pages 222, 226 and 227 are visually reviewed, with zero final warnings. Shared API snapshots are unchanged. Original Docs CI 977 and 978 are running. These documentation corrections add no runtime behavior; the previously retained Integration78557a6c672ecf426dfe894a01cc4aeec73b5e3cappliance retains its original source selection and passing guarded-preparation evidence. Native upstream Rust/LLVM rebuilding and both complete EriX builds remain required.Original Docs CI 977/978 passes for signed 7b79f8d50ab1aa123c6c74c427f5aa1a50a1db9d. All four complete hashed logs total 772,186 bytes. Both runs pass 45 tests and the full 2,419-page manual; successive TeX passes retain 36/1/0 warning observations, with zero final-pass warnings. No unchanged workflow rerun or cancellation supplies this result.
Minimum bootstrap design — 19 September 2026: signed Posixd proposal, in PR 5, specifies the next ownership boundary before codec or runtime implementation. Launchd uses its existing endpoint factory and retains the private configuration RECV/GRANT alias; the child receives only its existing control RECV and a guarded configuration SEND. Counted startup records and actual receipts must agree, with all temporary setup/grant disposal acknowledged before the separate private start gate.
Readiness requires actual CLAIM caller identity plus an acknowledged challenge through the retained control endpoint. COLLECT provides no server-origin evidence. Child-read-only startup mappings do not revoke Procd's trusted memory-write authority, and ordinary writable LCS1 startup mappings cannot silently stand in for this new contract. The current staged-only retirement path must gain exact running-child cleanup. A surviving child-termination owner after Procd loss remains a prerequisite: SEND lifetime revocation alone does not destroy that child, and Rootd exits after bootstrap. Resolve and validate this ownership before admitting private execution.
The proposal assigns no new wire layout/opcode and implements no Posixd runtime. Markdown, canonical document headings, governance bytes, local links, original source anchors and whitespace pass. Original Posixd CI 19 and 20 pass from two complete hashed logs (7,212 bytes), without warnings. Rust and new VM checks do not apply to this documentation-only repository. Existing native guarded-preparation acceptance remains separate; full runtime lifecycle, configuration/seal, real client I/O, full frame proof, native upstream toolchain rebuilding and both full EriX build generations remain open. No whole acceptance item is added.
Native child-lifetime prerequisite — 19 September 2026: Kernel design #19 now specifies opt-in custody through existing Process control authority plus the real matching install grant, with actual current supervisor attribution and separate stopping/reclamation obligations. An install grant alone must not confer child termination authority. The shared exit/kill prerequisite is signed, strictly validated and passes both original native lifetime/invocation scenarios at Integration
a62d1381f56a01afc692112d9b427205eaeb6a2e. The custody binding, safe reclamation progress point and producer adoption remain unimplemented. No private mediator start gate opens from this refactor.erikinkinen referenced this pull request from erix/docs2026-09-12 20:52:05 +02:00
erikinkinen referenced this pull request from erix/docs2026-09-13 06:48:58 +02:00
WIP: Specify isolated POSIX realm ownership and bootstrapto WIP: Specify realm bootstrap and native retirement ownershipWIP: Specify realm bootstrap and native retirement ownershipto WIP: Specify staged mediator custody and realm bootstrap ownershipView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.