probed

probed is the hardware discovery daemon for EriX.

EriX is a clean-room, capability-based microkernel operating system written entirely in Rust.

Technical requirements are tracked in the EriX requirements, conventions, and project documentation.

See:

• docs for design documents, specifications, and development plans.
• Related architecture repositories for kernel, services, libraries, drivers, and integration tooling.

Purpose of This Repository

This repository implements the EriX probe service daemon. Its purpose in EriX is to provide the probe service role through explicit IPC and startup authority.

Functionally, it implements the daemon runtime, state model, IPC handling, and validation tests. The repository keeps the implementation, interface contracts, tests, and documentation for that behavior in one reviewable ownership boundary.

The maintained responsibilities are:

• implement the probe service runtime and state model
• validate startup authority before accepting IPC requests
• handle length-checked service operations through the assigned endpoint set
• keep service behavior, tests, and authority invariants documented

Clean-Room Policy

EriX follows a strict clean-room philosophy:

• No external source code may be copied.
• No external Rust crates are allowed.
• No code generation tools that embed third-party code.
• All code must be authored within the project.

Violations will result in rejection of the contribution.

License

All EriX repositories are licensed under the ISC License.

Development Model

EriX development is modular, deterministic, reproducible, authority-explicit, security-first, and self-hosting oriented.

This repository follows the project roadmap and the validation rules documented in its own roadmap.

Build

cargo build --all-targets --all-features

Test

cargo test --all-targets --all-features
cargo clippy --all-targets --all-features -- -D warnings

Build and Test Modes

This repository supports additive runtime and integration feature gates.

• probed-runtime and probed-runtime-probe select production discovery behavior.
• *-integration-smoke remains available for synthetic end-to-end validation paths.
• *-integration-force-fail remains test-only and MUST NOT be enabled for runtime appliance builds.
• probed-runtime-release-image suppresses informational probe telemetry in packaged release images while preserving ERIX_PROBED:WARN:* records.

Validation Note

The host/test QUERY_CAP fallback remains cfg-scoped so runtime/release builds stay warning-free. Bare-metal startup validates installed capability types, rights, and endpoint kinds through the separate local capability-query syscall; the primary-control endpoint does not carry general CSpace query authority.

Logging Note

Probe/debug log submissions use the shared lib-log Rust-string submit helper. The service observes logical LogSubmitResponseV1 results instead of building LogdSubmitStringRequestV1 frames directly, and chunking remains owned by the logging client library without a local NUL scratch buffer. Runtime log helpers do not consume the primary-control slot or apply the retired fixed 96-byte kernel log-message cap. Packaged release runtime images keep warnings visible but suppress informational ERIX_PROBED:* discovery telemetry.

Dynamic Boot Artifact Evidence

The image build packages probed as an ELF64 x86_64 ET_DYN executable with .erix_dynlink metadata in the signed dynlink-store and mirrors it under /lib/erix/dynlink with its required shared objects.

Startup remains rootd through procd staged dynamic creation before dynlinkd; authority remains the dedicated platform-discovery-read endpoint and startup peers. Dynamic packaging and filesystem mirror records are evidence and launch inputs only; they do not grant filesystem, loader, object-store, service-discovery, provider-bypass, block-device, or dynlinkd authority. probed receives only the documented startup endpoints, peers, and capabilities for its role.

Governance Principles

probed governance is scoped to hardware/platform probe reporting.

The scoped governance rules are:

• It reports only probe data derived from authorized platform inputs.
• It retains each REPORT_DEVICE request and its static call buffer through pre-acceptance and accepted deviced backpressure, without a caller-local retry ceiling; terminal results end the transaction.
• It covers the complete PCI bus/device/function address domain selected by the runtime mode and returns deterministic device-management counters.
• Its primary-control endpoint exposes only platform-presence and PCI-config reads; it cannot query the local CSpace or invoke unrelated kernel control.
• It separates probe reporting from driver start and provider publication policy.
• It reports both the matched activation-policy identity and a checked physical identity derived from the discovered PCI location; it never fabricates one seeded physical disk identity for multiple functions.
• It rejects malformed probe inputs instead of manufacturing devices.

Authority Boundaries

• probed operates only through startup-assigned service capabilities.
• Probe requests and service replies carry no authority. Unexpected receipts are retired before rejection; malformed or uncleanable receipt state fails stop.
• Debug logging is optional before acceptance and retains its buffer after acceptance; device reports are required and retain their buffer throughout.
• Terminal startup, receive, reply, or required peer-call failures request process teardown so accepted calls and delegated authority cannot remain residual. Transient receive and cleanup backpressure yields cooperatively.
• One full canonical receive envelope is retained for inbound calls. The independent peer-call buffer is sized exactly to the larger of the only two typed call families rather than to an unrelated transport maximum.
• New authority must be represented in bootstrap/capability validation and integration tests before use.

Contact

Development occurs in EriX organization and discussions happen in issues and design documents.

No decisions are considered valid without documented rationale.

Maintainers can be reached via email: admin@erikinkinen.fi.